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The rapidly evolving external environment and increasingly 
complex banking business models are driving banks to 
adapt and embrace innovation and transformation to 
remain competitive. One important area to the HKMA 

is Regtech; harnessing the power of technology to 

create positive transformation of risk management and 
regulatory compliance processes. The value of Regtech in 
banking is coming to the fore in Hong Kong, offering clear 
benefits to banks, customers and regulators. 


Much has been done to promote Regtech in Hong 
Kong to date due to the collective efforts of the banking 
industry, the HKMA, the technology community and 
other stakeholders. This includes HKMA initiatives such 
as the opening up of our Sandbox and Chatroom to 
Regtech providers, issuing regular publications such as 
our “Regtech Watch” newsletters, introducing banks to 
Regtech use cases, and hosting events such as our first 
AML/CFT RegTech Forum last year. 


This white paper builds on this momentum. It sets out 
the case for wider adoption of Regtech in Hong Kong, and 
outlines a series of actions that the HKMA will take, or 
consider taking, to accelerate adoption. 


We hope that this white paper can be a useful MAP 
(‘Monitor’, ‘Assess’ and ‘Plan’) for users. ‘Monitor’ 
involves understanding the current and evolving Regtech 
landscape. ‘Assess’ involves analysing the existing 
practices and risks associated with Regtech, and ‘Plan’ 
involves putting our insights into practice by developing 
practical steps for the future. 
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Our white paper MAP breaks down this process into five 
key areas: 


1. Under Monitor, the white paper lays out new 
developments in Regtech, and explores their 
importance to Hong Kong's banking industry 


2. Under Assess, the white paper assesses current 
prevailing practice and also defines and evaluates the 
existing barriers to Regtech adoption 


3. There are three components under Plan. The first 
involves laying out a common practice framework for 
implementing Regtech in Hong Kong 


4. The second involves making practical 
recommendations for initiatives that will contribute to 
the wider adoption of Regtech 


5. The final one is delivering a practical roadmap of the 
HKMA’‘s plans for promoting Regtech adoption over 
the next two years. 


We believe that this white paper will encourage banks in 
Hong Kong to actively consider the business challenges 
that can be solved with Regtech. We want to see banks 
embracing and trialling new technologies and proofs of 
concept, and ultimately adopting more Regtech solutions. 
There are also opportunities for the Regtech community 
to develop their solutions for the Hong Kong market. 


We would like to thank all the survey respondents and 
interviewees who contributed to this white paper. 


Arthur Yuen 
Deputy Chief Executive 
HKMA 
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eXBCULIVE summa 


The rise of ‘Regtech’ - the use of technologies that 
enhance efficiency and/ or the effectiveness of risk 
management and regulatory compliance - presents 
opportunities to unlock significant benefits for banks, 
regulators and the wider economy. Significant progress 
in facilitating Regtech adoption in Hong Kong has 
already been made and technologies are becoming 
increasingly powerful. 


If the key barriers to adoption can be overcome, 
then Regtech adoption and the realisation of these 
significant benefits can be accelerated. 


Banks’ evolving business models, regulatory initiatives 
in response, and a challenging external environment 
continue to drive banks to explore the use of technology 
to enhance risk management and compliance. Technology 
is becoming increasingly powerful across both established 
and emerging areas, such as artificial intelligence, cloud 
and distributed ledgers. The traditional lens through which 
banks and regulators view compliance is changing, creating 
significant opportunities to leverage Regtech solutions 
across a wide range of application areas. 


Against this backdrop, the Hong Kong Monetary Authority 
(HKMA) commissioned KPMG to develop a white paper to 
explore the current state of Regtech in Hong Kong, examine 
common practices and barriers to adoption, and outline a 
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roadmap to accelerate adoption in the banking sector. 


The research for this white paper is based on surveys 


conducted with local banks and Regtech providers, as well 


as in-depth interviews with banks, Regtech firms, local and 


overseas regulators and other industry stakeholders. 


Key findings 


Substantial progress in facilitating Regtech adoption 
has been made in Hong Kong in recent years. Initiatives 
from the regulators, the growth and increasing role of 
relevant industry associations, and the presence of local 
and international Regtech firms are all recognised as 
positive developments. 


The effective implementation of Regtech solutions can 
reduce cost, improve risk management and increase 
efficiency for banks, as well as enhance supervision 
for regulators. More widespread adoption would 
also help to strengthen Hong Kong's position as an 
international financial centre, maintain the banking 
sector's competitiveness, and help Hong Kong fulfil 


its pivotal role in the Greater Bay Area's development. 


One-third of the surveyed banks have fully implemented 
at least one Regtech solution; there are significant 
opportunities to encourage banks that have yet to 
implement Regtech and those that have already 
adopted solutions to improve implementation and 
expand use cases into emerging areas. 


26 specific application areas have been identified across 
six broad fields: Regulatory Compliance Obligations, 
Crime, Conduct & Customer 
Regulatory & Tax Reporting, Risk Management, and 
Governance & Accountability. As a result of Regtech 
developments driven by the HKMA, financial crime, 


Financial Protection, 


risk management and regulatory reporting are viewed 
as the areas with more mature solutions in Hong Kong. 
There are significant opportunities for banks to adopt 
solutions in these areas, and to explore new solutions 
in emerging application areas. 


Budgetary and capability constraints, as well as the 
lack of available and established solutions catering to 
local requirements are the main adoption challenges 
for banks and Regtech providers. There is a need 
for targeted intervention in order to overcome these 
challenges. 


Recommendations 


The extensive research culminated in the formulation of 16 
recommendations across five core areas which, if realised, 
would help to achieve a number of goals: 


Hong Kong as a global leader in Regtech 


Extensive adoption of Regtech in the Hong Kong 
banking sector 


Breeding ground of Regtech solutions for financial 
institutions 


Hong Kong as a hub for nurturing Regtech talent. 
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Figure 1: Overview of recommendations 


Encourage exchange of knowledge about Regtech by 
creating a Regtech knowledge hub 


Improve sharing of experience in implementing Regtech 
through issuing Regtech adoption practice guides 


Boost widespread awareness about Regtech across the 
industry by hosting targeted events 


Build acceptance of key technologies that enable Regtech 


Boost : J aie 
adoption via targeted events and publications 


awareness 


Accelerate Regtech adoption by exploring the benefits of 
providing financial incentives and other assistance 


Attract global Regtech firms to develop and showcase 


solutions for common problem statements by hosting a 


J Regtech Challenge 
~ Promote E 3 


solution 
innovation 


Address common pain points by encouraging the formation 


of consortiums 


Stimulate new innovation by facilitating better access to 
existing infrastructure and developing new infrastructure 


Encourage cross-border Regtech collaboration via targeted 
outreach 


engagement . Create an environment conducive to international Regtech 
with eco- implementation by continuing to engage regulators in 
system other jurisdictions, including the Greater Bay Area 


. Reaffirm the HKMA’s focus on promoting Regtech 
development by continuing to communicate and share 
Regtech-related expectations and guidance to the broader 
Regtech community 





Develop 
talent pool . Nurture a Regtech talent pool by developing a skills 
framework for Regtech adoption 






13. Formalise Regtech training by exploring the idea of 
introducing or enhancing Regtech modules for relevant 
industry courses 







f . Expand the Regtech ecosystem by continuing to work with 
Sustain financial institutions and other regulators in Hong Kong 
adoption 






15. Provide a clear way to measure and guide success in 
Regtech adoption by developing and publishing a Regtech 
Adoption Index 







16. Magnify impact of the initiatives by enhancing the 
collaboration with Regtech-related industry associations 






Source: KPMG analysis 


The value of Regtech in banking is being brought to the 
fore in Hong Kong, with industry stakeholders starting to 
realise that Regtech and its underlying technologies are 
the way of the future for risk management and compliance. 
Hong Kong has the right foundations to support a thriving 
Regtech ecosystem: broader fintech capabilities, strong 
support for technology businesses, a large and established 
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financial services sector, and supportive regulators. Our 
hope is for this white paper to encourage banks in 
Hong Kong to actively consider the business challenges 
that can be solved with Regtech, embrace and trial 
new technologies and proofs of concept, and ultimately 
accelerate the adoption of more Regtech solutions. 


The HKMA is taking a proactive role in facilitating Regtech adoption. The HKMA 
will work closely with the banking industry, the Regtech community and relevant 
government agencies to increase interaction and collaboration among these 


stakeholders. 


Raymond Chan 


Executive Director (Banking Supervision), HKMA 


About the research 





The HKMA-KPMG research for this white paper is based on: 


e A survey of 133 Authorized Institutions in Hong Kong, conducted in July and August 2020. 


e A survey of 47 Regtech providers, conducted in July and August 2020. 


e Interviews with over 70 individuals from a range of banks, Regtech providers, local and overseas 


regulators, and industry associations. 


e Analysis of public reports and publications on Regtech, its related technologies, and its application 


areas and use cases. 


e Subject matter expertise across the HKMA and the KPMG network. 


We would like to take this opportunity to thank all the survey respondents and interviewees who kindly 


contributed to this white paper. 
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2.1 Development of Regtech 


Regtech emerged in the late 2000s and has matured 
significantly in the past five years. 


Financial institutions have been using technology to improve 
the effectiveness and efficiency of their risk management 
and regulatory compliance activities long before the 
term “Regtech” was coined. Regtech in its current 
form emerged in the late 2000s as financial institutions 


and providers began to harness a new generation of 
technologies, such as cloud, artificial intelligence (Al) and 
application programming interfaces (APIs), in a range of 
solutions under the wider umbrella of fintech. 


The growing volume of regulation designed to reduce risk 
in the financial system following the Global Financial Crisis 
and high-profile anti-money laundering (AML) scandals 
have further accelerated the development and adoption 
of Regtech in its current form. Although the rate of 
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increase in new regulation has eased in recent years, the 
volume of regulatory alerts” remains high in a historical 
context, numbering more than 56,000 in 2019 according 
to Thomson Reuters (Figure 2), or approximately one new 
regulatory alert every nine minutes. 


The term “Regtech" was coined by the UK Government 
Office for Science in their 2015 Fintech Futures Report’. 
The creation of the term Regtech as a sub-set of fintech 
has since gone on to help raise awareness and stimulate 
interest among financial institutions and service providers 
alike. Today, many regulators have some form of guidance 
or initiatives that are designed to promote the use of 
Regtech. There is significant interest from investors with 
total global investment activity in Regtech hitting USD 3.4 
billion in 2019. Data from the first half of 2020 suggests 
that investment activity could surpass this figure in 2020 
(Figure 3). 


Figure 2: Number of regulatory alerts generated per year 


Regtech is expected to continue to grow as we enter the 
2020s amid emerging new risks from increasingly digital 
business models and a challenging external environment. 
There is also an increasing expectation from both the 
regulators and the public for banks to maintain a high 
level of risk management, and to act in the best interests 
of consumers and the market. As banking becomes 
more complex, there is a growing need to meet these 
expectations in a cost-effective manner through Regtech 
solutions. 


Increasing digitalisation is a well-established trend in the 
financial services industry. The onset of COVID-19 is likely 
to accelerate the adoption of digital technologies and raise 
awareness about available technologies and solutions in 
the market, as well as their benefits. 


56,321 57.364 56,624 


51,563 52,506 





2018 2009 2010 2011 2012 2013 


2014 2015 2016 2017 2018 2019 


Source: Regulatory Intelligence Feeds, Thomson Reuters (2020), https://legal.thomsonreuters.com/content/dam/ewp-m/documents/legal/en/pdf/ 


brochures/tr_regulatory_intelligence_desktop_digital_us.pdf 





^ Notification based on regulatory news, including circulars, guidance and other announcements, that is captured by Thomson Reuters Regulatory Intelligence 
' Fintech Futures -The UK as a World Leader in Financial Technologies, UK Government Office for Science (April 2015), https://assets.publishing.service.gov.uk/government/uploads/system/ 


uploads/attachment_data/file/413095/gs-15-3-fintech-futures. pdf 
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Figure 3: Total global investment activity (Venture Capital, Private Equity and Merger & Acquisition) in Regtech 


178 


143 


2017 


2018 





Deal count BB Deal value (USS bin) 





176 


89 





2020H1 


2019 


Source: Pulse of Fintech H1 2020, KPMG (September 2020), https://assets.kpmg/content/dam/kpmg/xx/pdf/2020/09/pulse-of-fintech-h1-2020.pdf 


2.2 The benefits of Regtech 


Greater Regtech adoption in Hong Kong offers clear 
benefits to financial institutions, customers, regulators 


and to overall economic growth. 


Benefits to financial institutions 


Enhanced risk management: A key benefit of greater 
Regtech adoption is the harnessing of new technologies 
to enable financial institutions to better manage a wide 
range of risks. The financial and reputational consequences 
of poor risk management can be significant. Globally, 
financial institutions have paid more than USD 340 billion 
in fines since the Global Financial Crisis?, and continue 
to face regulatory penalties related to lapses in market 
conduct, AML systems, regulatory reporting, information 
and consumer protection. Alongside the significant fines 
are the costs of remediation, which can be multiples of the 
fines paid. 


Regtech offers a number of benefits to improve compliance 
and risk management. 


Reduces human error: Regtech solutions tend to be 
highly automated and require less human intervention. 
They can therefore reduce the operational errors 
associated with maintaining heavily manual paper and 
email-based processes. 


Enhances monitoring/ sampling: Regtech solutions can 
facilitate faster analysis and checking of larger quantities 
of data, enabling a more comprehensive review of large 
data sets as compared to a sample-based approach. 


Facilitates predictive analytics: Regtech solutions 
can equip financial institutions with new or improved 
predictive analytics that trigger earlier investigations 
of potential issues, for example in fraud detection and 
default risk management. 


2 Regtech Beyond Compliance, KPMG (March 2020), https://home.kpmg/xx/en/home/insights/2019/03/beyond-compliance-fs.html| 
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e Enables professionals to focus on higher value tasks: 
By automating process-orientated tasks, Regtech 
solutions can enable professionals to focus on more 
value-added tasks such as dealing with regulatory 
change and advising front office functions. 


Reduced costs: Cost management has been a key focus 
for financial institutions in recent years, and is becoming 
an increasingly important lever in maintaining profitability 
amid the challenging business environment exacerbated 
by COVID-19. If implemented correctly, Regtech can 
bring significant cost advantages to financial institutions. 
Interviewees highlighted the growing importance of cost 
reduction as a reason for Regtech adoption. According 
to one study, global regulatory compliance spending is 
expected to increase from approximately USD 278 billion 
in 2019 to more than USD 316 billion by 2024°. Research 
also shows that a typical bank serving 10 million customers 
can potentially save up to 40% in costs annually by 
implementing technology to improve KYC processes’. 


Attract and retain customers: Regtech solutions can 
help to enhance customer experience by allowing required 
compliance checks to be completed more efficiently, 
delivering a faster and more efficient service. Regtech 
can therefore be leveraged by financial institutions as 
a competitive advantage that can aid in attracting and 
retaining customers. 


Benefits to customers 


Improved customer experience: Regtech provides 
significant opportunities to improve customer experience. 
Regulatory requirements are often cited as a reason for 
slow service. The adoption of technologies such as Optical 
Character Recognition (OCR) and Al can help speed up 
the processing of regulatory compliance checks. The 
recently launched virtual banks in Hong Kong, which use 
these technologies, have shown so far that regulatory 
requirements can be met while raising the bar for customer 


experience. 


There are also benefits in terms of opportunity costs 
as the effective use of Regtech can free up front office 
staff to spend more time focusing on their customers. 





reach-$127-billion-by-2024 


rs 


a 


report-2018.pdf 


o 


For example, relationship managers in the private wealth 
management industry in Hong Kong spend about 42% of 
their time on administration-related work®, which includes 
complying with a range of on-boarding, suitability and 
disclosure requirements. The use of Regtech solutions 
could reduce the time spent on such administration-related 
work. 


Drives financial inclusion: While considerable efforts® have 
been made over the past few years, there are still certain 
customer segments that experience difficulties transacting 
or opening accounts due to financial institutions’ concerns 
around regulatory compliance. For example, 10% of small- 
to-medium enterprises in Hong Kong find it challenging 
to open bank accounts and 31% find it challenging to get 
access to credit’. The adoption of Regtech solutions using 
alternative data could be used to help assess customer and 
credit risk and improve access to financial services. 


Benefits to regulators 


Reduced risk in the financial system: The effective 
implementation of Regtech by financial institutions can 
help to reduce residual risks at the institutional level and 
should, in aggregate, equate to better management of risk 
in the financial system. 


Enhanced supervision: Most supervisory agencies have 
historically collected summarised data on a periodic basis. 
Regtech presents opportunities to transform this approach 
by allowing reporting institutions to automatically package 
business data in a much more granular form on a more 
timely basis. This can help regulators rapidly respond to 
changing conditions, for example in a crisis. 


Increased efficiency: The adoption of Regtech by financial 
institutions can help regulators carry out their supervisory 
activities more efficiently. For example, addressing 
minor inconsistencies in regulatory reporting can draw 
attention away from more pressing priorities. This could 
be a particular issue for the large number of foreign bank 
branches that may have staff seconded from their home 
jurisdiction, and who may need time to get up to speed 
with local requirements. 


Regtech Spending to Reach $127 billion by 2024, as Al Drives Cost Savings, Juniper Research (September 2019), https://www.juniperresearch.com/press/press-releases/regtech-spending-to- 


Regtech 3.0: Easing the Cost of Compliance, International Banker (February 2020), https://internationalbanker.com/finance/regtech-3-0-easing-the-cost-of-compliance/ 
Hong Kong Private Wealth Management Report 2018, KPMG PWMA (September 2018), https://assets.kpmg/content/dam/kpmg/cn/pdf/en/2018/09/hong-kong-private-wealth-management- 


Introduction of Tiered Account Services, Hong Kong Monetary Authority (April 2019), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2019/20190412e1.pdf 


Credit Risk Management for Personal Lending Business, Hong Kong Monetary Authority (May 2018), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 


circular/2018/20180509e1.pdf 


Guidelines on Credit Risk Management for Personal Lending Business, Hong Kong Monetary Authority (August 2019), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 


circular/2019/20190829e1.pdf 


releases/2020/07/20200729-4/ 


Survey on Small and Medium-Sized Enterprises’ Credit Conditions for Second Quarter 2020, Hong Kong Monetary Authority (July 2020), https://www.hkma.gov.hk/eng/news-and-media/press- 


“Authorized institutions, as defined by the HKMA, include licensed banks, restricted licence banks and deposit-taking companies. 
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Benefits to Hong Kong 


Enhances the competitiveness of the banking 
sector: Hong Kong has a thriving banking industry with 
194 Authorized Institutions (banks) that are important 
contributors to the economy. The banking industry 
alone employed over 100,000 skilled professionals and 
contributed more than HKD 349 billion to GDP (12.9% 
of total GDP) in 20188. A key component of the 
HKMA‘s Banking Made Easy initiative, greater Regtech 
adoption and the associated risk management, cost and 
customer experience benefits can help to increase the 
competitiveness of Hong Kong's banking industry. 


Strengthens Hong Kong's status as an international 
financial centre: As a leading global financial centre, Hong 
Kong remains a global leader for IPOs and an important 
hub for wealth management, asset management and 





insurance. Many Regtech use cases extend beyond the 
banking industry, so the more widespread adoption of 
Regtech is likely to benefit other sectors and boost Hong 
Kong's overall global competitiveness. Furthermore, recent 
government initiatives to promote Hong Kong as an asset 
management hub — such as the new Limited Partnership 
Fund regime, updates to offshore funds tax exemption 
and the open-ended fund company regime — could help to 
attract more private equity funds to set up onshore. The 
launch and growth of domestic Regtech companies may 
present attractive investment opportunities for the growing 
number of private equity and venture capital firms in Hong 
Kong. 


Promotes Hong Kong's development as an innovation 
and technology hub: The greater adoption of Regtech 
supports the wider ambitions of the Hong Kong SAR 
Government to transform Hong Kong into an innovation and 


® The Four Key Industries and Other Selected Industries, Census and Statistics Department (2018), https://www.censtatd.gov.hk/hkstat/sub/sp80.jsp?tableID=188&ID=0&productlype=8 
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technology hub. This has long been an ambition set out in 
numerous addresses from the Hong Kong Chief Executive. 
In recent years, this has led to a range of initiatives such 
as the expansion of Cyberport, the development and 
location of research institutions in Hong Kong Science & 
Technology Park, research and development (R&D) tax 
incentives, and immigration and cross-border technology 
cooperation. Encouraging more financial institutions to use 
advanced technologies such as Regtech would help to 
grow the vendor ecosystem and deepen the talent pool for 
relevant skills. 


Supports Hong Kong's role in the Greater Bay Area: 
Hong Kong has a crucial role to play in the development 
of the GBA. As identified in the Outline Development Plan 
for the Guangdong-Hong Kong-Macao Greater Bay Area’, 
Hong Kong should leverage its position as an international 
financial, asset management and risk management centre, 





and offshore RMB hub. The city’s other goals include 
promoting the development of high-end industries, 
strengthening innovation and technology, nurturing 
emerging industries and increasing global competitiveness. 
The greater adoption of Regtech would facilitate Hong 
Kong in fulfilling its role in the GBA’s development, leading 
to significant growth and benefits for both technology 
companies and financial institutions in the region. 


Strengthens Hong Kong’s role as an East-West 
connector: Hong Kong's key role in connecting companies 
from the region and worldwide could see more financial 
institutions and technology companies invest in and pilot 
Regtech solutions in Hong Kong before rolling them out to 
other markets. This could help to lead to more widespread 
adoption of Regtech in Hong Kong. 


® Outline Development Plan for the Guangdong-Hong Kong-Macao Greater Bay Area (February 2019), https://www.bayarea.gov.hk/filemanager/en/share/pdf/Outline_Development_Plan.pdf 
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2.3 The underlying 
technologies 


Regtech solutions are expected to become increasingly 
powerful as the underlying technologies mature. 


Overview of underlying 
technologies used in Regtech 


Regtech is underpinned and enabled by a number of 
prominent emerging and established technologies. These 
vary from more established technologies such as cloud to 
more emerging areas of Natural Language Processing (NLP) 
and the Internet of Things (loT). As these technologies 
continue to evolve and mature, they are expected to 
enable the creation of more powerful solutions. The key 
technologies that underpin and enable Regtech solutions 
are further detailed below. 


Key underpinning technologies 


e Cloud computing is the on-demand delivery of IT 
resources over the internet, typically computing power 
or data storage. This enables financial institutions to 
operate with lower costs without the need to purchase 
and maintain equipment, to have greater flexibility 
to generate, store, manage and use data, along with 
enhanced data security and advanced data protection. 
This also enables users to access applications at any 
time, from any location and from any device. Many 
Regtech solutions are cloud-based and therefore use 
cloud computing as a key underpinning technology. 
Emerging anecdotal evidence suggests that financial 
institutions that were open to using cloud-based 
technology have been more successful in adopting 
Regtech solutions during the COVID-19 pandemic, and 
have therefore displayed greater operational resilience. 


e Application Programming Interface is a computer 
programming approach for facilitating exchange of 
information and executing instructions between 
different computer systems. Given the complexity of 
banking systems and the need for Regtech solutions to 
smoothly interface with banks and other third parties, 
API is a crucial underpinning technology for Regtech 
adoption. 


Emerging technologies 


Artificial Intelligence is an overarching concept that 
refers to different emerging technologies by mimicking 
cognitive functions of humans such as problem-solving, 
speech recognition, visual perception, decision-making 
and language translation. Al can help to automate 
business processes, detect patterns, generate insights, 
and engage customers and employees through routine 
communications. Specifically, Al can help analyse and 
interpret data at scale and in real-time. This provides 
predictive insights and alerts on a timely basis for more 
comprehensive risk monitoring. 


Machine Learning is a branch of Al and a popular 
technology that is expected to have a transformational 
impact on companies in the coming years. Machine 
learning enables continuous improvement and more 
accurate and predictive analytics from large and more 
complex data sets. 


Natural Language Processing is a branch of Al that 
allows systems to recognise and interpret meaning 
from human languages, and creates a means of two- 
way communication between systems and users. Both 
text and audible speech can be analysed or generated 
using either a symbolic approach (rules set by linguistic 
experts), statistical approach (models generated based 
on observed samples), or both. It is commonly used 
in fintech and Regtech solutions in applications such 
as chatbots and tools that automate the process of 
gathering customer information from a wide range of 
sources. 


Optical Character Recognition is a form of technology 
that identifies and converts text from a variety of 
documents into digitised data. It enables mass extraction 
of information from a wide range of sources that would 
otherwise require labour intensive manual data entry. 
OCR acts as an enabler of other technologies that 
underpin Regtech solutions by converting information 
into data in a format that allows for consumption by 
machine learning, NLP and other techniques that 
benefit from larger data sets. 
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e Internet of Things is a system that connects devices 
to the internet, enabling more real-world data to 
be collected, interpreted and used, and improving 
productivity with the ability to monitor and control a 
wider range of processes. With larger adoption of digital 
devices, loT can increasingly be leveraged by banks 
for a range of uses. For example, sensors installed 
in warehouses and ports can track raw materials and 
inventory stocks to check for fraud or financial crime 
if goods move through sanctioned ports. Consumer 
applications include comparing mobile phone location 
data and transaction data to identify fraud. 


e Distributed Ledger Technology (DLT) is a modern 
database system using Blockchain technology. It is 
commonly used to record transactions of assets, 
providing a secure, immutable and auditable trail of 
information about the asset. The technology does so 
by encrypting the available information and storing it 
across multiple servers at the same time. In the realm of 
Regtech, DLT provides a way of constructing a secure 
record system that offers increased transparency, trust 
and provenance of data to multiple parties in real time. 


e Biometrics use the unique biological characteristics 
of an individual to verify their identities, providing 
greater security and assurance on identity verification, 
and offering a better user experience with more 
convenient processes. Virtual banks in Hong Kong are 
using biometric checks to enable remote on-boarding, 
bypassing the need for physical identity checks, hence 
reducing on-boarding time, and enhancing flexibility and 
customer experience. 





18 | Transforming Risk Management and Compliance: Harnessing the Power of Regtech 


2.4 Regtech application areas 


There are many exciting new use cases being investigated on 


a daily basis, to the extent that generating a comprehensive 


26 specific Regtech application areas have been list 


identified for the purpose of this white paper, which 
present opportunities to realise benefits for financial 


institutions. 


Figure 4: Overview of Regtech application areas 


e Cyber risk management 


e Third-party monitoring and 
risk management 


e Liquidity risk management 
e Market risk management 
e Credit risk assessment 

e Stress testing 

e Model validation 


e Regulatory reporting 
e CRS/ FATCA 
e Tax compliance 


Source: KPMG 


is challenging. The 26 application areas identified in the 


survey outline the more prominent examples seen in the 
banking industry (Figure 4). 


e Governance and accountability 


Regulatory 


Risk 
Management 


ernance & Account, 
(Cà 


G 


bilig e Maintaining inventory of 
4 all internal and external 
compliance obligations 


i.e. GR 
Compliance (i.e. GRC) 
Obligations e Cross-border regulatory 
compliance 


© e Regulatory horizon scanning 
e Operational resilience from 
regulatory change 


Regulatory 
Themes 


SSS, 


©) 


Conduct & 
Customer 
Protection 


Sales practices and suitability 
Product due diligence 


Regulatory 
& Tax 
Reporting 





Product disclosure 
Best execution/ pricing 
Customer data and privacy 


© Financial 

Crime © 
e Customer on-boarding 
e Name screening 


e AML transaction monitoring 


e Ongoing monitoring of 
customers (e.g. fraud, credit) 


e Customer off-boarding 


Monitoring and surveillance of employees (e.g. fraud) 


Regulatory compliance obligations 


e Maintaining inventory of all internal and external 
compliance obligations is often managed in an 
integrated and organisation-wide Governance, Risk 


and Compliance (GRC) 


platform. The successful 


implementation of GRC strategies maximises the 
effectiveness of an organisation's control framework 
while driving consistency, transparency and efficiency 
across the three lines of defence. GRC solutions 
are technology-enabled products and services that 
integrate, streamline, and maximise the efficiency and 
value of an organisation's GRC strategy, providing a 


single source of truth. The next generation of solutions 
should be capable of monitoring regulatory obligations 
and updating regulatory inventories for changes in the 
regulatory environment, with as few manual processes 
as possible. This can significantly reduce the resource- 
intensity of traditional processes. 


Cross-border regulatory compliance involves tracking 
and complying with other regulatory requirements 
across jurisdictions. This is particularly important for 
Hong Kong given the volume of business covering 
multiple regulatory environments, as well as the 
regional nature of many business and operating 
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models across Asia-Pacific. Regtech solutions in this 
area should contribute to a centralised GRC platform, 
providing financial institutions with an effective means 
of monitoring and ensuring compliance with regulatory 
obligations in all relevant jurisdictions. This means that 
compliance teams can be more centralised with fewer 
resources. 


Regulatory horizon scanning involves tracking, 
identifying and monitoring relevant regulatory changes 
and determining their impact across the institution. 
Horizon scanning is an important component of a 
successful regulatory change management system. A 
major challenge in this area is building the capability 
to identify new or changing sources of regulations, 
particularly when a jurisdiction undergoes a major 
change to its regulatory framework or environment 
(e.g. structural changes to key regulators, changes in a 
regulator's mandate or the creation of new regulators). 
With advancements in OCR engines and the potential 
for regulators to adopt machine-readable regulations 
(MRR) in the future, Regtech capabilities in this area 
have the potential to become increasingly powerful, 
especially when integrated into an enterprise-wide GRC 
platform. 


Operational resilience from regulatory change is 
the strengthening of system and process resilience 
to enable an institution to continue to operate as 
regulatory requirements change. This closer view on 
how regulations impact operations is what distinguishes 
this area from the regulatory inventory and horizon 
scanning operational areas. 


Financial crime 


Customer on-boarding refers to establishing a 
business relationship with a customer, a crucial part of 
which is the Know Your Customer (KYC) process, which 
involves determining the true identity of the customer 
and understanding the customer's background, 
including the type of activity that is expected to enable 
the bank to assess money laundering and terrorist 
financing risk. Remote customer on-boarding refers 
to customer on-boarding processes solely through 
electronic channels such as mobile applications or the 
internet. A significant portion of the Regtech pilot trials 
conducted in the HKMA’s Fintech Supervisory Sandbox 
2.0 have also been related to remote on-boarding. A 
variety of authentication technologies underpin these 
solutions, including machine learning, facial recognition, 
geo-location recognition and liveness detection, have 
been adopted by retail banks. For example, in a 


two-stage verification process, machine learning 
can be applied to ascertain the authenticity of the 
identification document uploaded by a customer (i.e. 
identity authentication), and then a combination of 
facial, liveness and geo-location recognition may be 
used to confirm that the person on-boarding is indeed 
the person that owns the identification document (i.e. 
identity matching). Information about the customer's 


background and expected activity is collected digitally, 





with the customer's authorising signatures replaced 
by multi-factor authentication using a combination of 
biometrics, passwords or one-time passwords. 


Name screening of new and existing customers 
and payments helps ensure compliance with relevant 
legislation and regulations. Enhanced checks on 
matches are required to determine whether they 
are genuine hits. The global nature of relationship 
networks and databases means that solution providers 
benefit from scale advantages, favouring global players. 
Traditional manual methods are slow and resource 
intensive, and often provide limited information that 
fails to capture the full network of relationships. Using 
advanced data mining techniques, Regtech solutions 
have the potential to quickly and efficiently identify 
high-risk entities and individuals. Process automation 
and machine learning can also help to tackle the manual 
review of matches, increasing overall efficiency. 


AML transaction monitoring aims to detect unusual 
activity, based on the understanding of the customer's 
background and account opening purpose. Traditional 
systems typically use rules-based algorithms calibrated 
to a set of pre-defined scenarios and thresholds that have 
been determined to identify patterns of potentially illicit 
activities, subject to further investigation by analysts. 
However, the large volume of false-positives generated 
by rules-based methods is a well-documented industry 
challenge, and one that Regtech solutions are seeking 
to resolve. These solutions tend to use supervised 
machine learning techniques, using the large volume 
of transactions as training data to identify common 
patterns in order to prevent incorrectly flagging and/ or 
reduce the volume of certain types of false-positives in 
the future. 


Ongoing monitoring of customers involves continuous 
review of the customer's information to refresh the 
institution's understanding of the customer's personal, 
professional or economic situations, activities and 
transactions. This is key to having the ability to identify 
potential changes in the customer's financial crime 
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risk profile and take measures to mitigate any risks. 
Regtech solutions in this area make use of continuous 
data gathering on the customer from public sources and 
subscribed databases, and flag only the news items 
that are relevant in the context of financial crime risk. 
For example, Al can flag a media report on a customer 
becoming the subject of a criminal investigation for 
review, while discarding reports of a non-criminal 
nature. 


Customer off-boarding is often overlooked as a 
process to identify and off-board customers for risk- 
related reasons. Customer profiles should be reviewed 
periodically or when an event occurs that impacts the 
customer's risk profile, especially when it is related 
to financial crime such as tax fraud and identity 
fraud. Although these customers are flagged by 
ongoing monitoring processes, it can become an 
operational burden if these accounts are not closed 
despite the ceasing of business relationships. Best 
practices involve proactively managing and removing 
inactive customer accounts to minimise the cost of 
maintaining them. Regtech solutions can help reduce 
the manual administrative work required to off-board 
customers by streamlining and automating parts of the 
process, such as the intelligent generation of customer 
communications with automated delivery. 


Conduct & customer protection 


Sales practices and suitability refers to the reasonable 
steps that banks are expected to take in order to ensure 
that investment solicitation and recommendations are 
suitable for a particular customer. Regtech has the 
potential to help in three ways. First, by providing the 
tools to assist frontline staff in minimising manual 
processes when conducting a suitability assessment. 
Second, by increasing compliance rates of frontline 
staff which can reduce the burden on second line 
risk and compliance staff, and third, by providing the 
tools to assist second line risk and compliance staff 
in automating parts of the monitoring process. For 
example, there are tools that automate the risk profiling 
of customers and aim to reduce bias in risk profiling 
questionnaires. 


Product due diligence should be conducted by banks 
in order to obtain a thorough understanding of the 
investment products being solicited or recommended 
to customers. The mechanism for assessing product 
risks and assigning product risk ratings to investment 
products should be reasonable and take into account 
all relevant factors. There are a number of challenges in 
this area that Regtech could potentially address. 


For example, solutions that can automatically take local 
regulatory requirements and market circumstances into 
consideration could help reduce the burden on local 
staff in conducting due diligence on products where the 
work had already been performed by the head/ regional 
office outside of Hong Kong. 


Product disclosure should be adequately provided to 
customers, varying in detail depending on the product 
nature and complexity. This covers any material and 
advice provided at the promotional, sales and advice, 
and post-sale stages. Preliminary compliance checks of 
promotional materials are typically performed manually 
by product managers and escalated to, and signed off 
by, compliance staff. There are Regtech firms that are 
developing tools to help product managers identify 
compliance issues early, which can reduce reliance on 
compliance teams and assist them by automating parts 
of the compliance assessment process. Some tools 
are able to analyse image, voice and video files, and 
assess against both prescriptive and principle-based 
regulations to determine whether there is a potential 
breach. 


Best execution/ pricing refers to the obligation to 
deliver best execution of trade orders on behalf of 
customers on the best available terms given the existing 
market environment. With the increasing regulatory 
focus on best execution monitoring, Regtech solutions 
can help benchmark trade details to monitor pricing 
quality, execution latency and order slippage. This 
provides financial institutions with better information 
to systematically monitor and review trading activities 
for potential compliance issues in a timely manner. 
Effective solutions also provide a competitive advantage 
by generating sustainable value for clients. 


Customer data and privacy regulations are increasing 
around the world both in importance and in reach. 
Protecting the confidentiality of customer data and 
implementing relevant security controls to prevent 
and detect any loss or leakage of data are becoming 
increasingly challenging and labour-intensive. Regtech 
solutions in this area can help companies comply with 
these regulations. 


Monitoring and surveillance of employees is 
important to ensure regulatory compliance and to 
identify a broad range of potential issues related to 
conduct (e.g. insider trading, fraud and misconduct), 
performance, culture and sentiment. Use cases are 
emerging in each of these areas with a wide range of 
emerging technologies. For example, NLP and voice 
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analytics can be applied to employees’ communications 
with customers to identify potential signs of stress or 
negative sentiment. This allows for the early detection 
of risk and enables timely intervention, which could 
potentially protect revenue or save costs. 


Regulatory & tax reporting 


Regulatory reporting involves the submission of raw 
or formatted data — prudential returns, for example — as 
required by regulators to evaluate and track the financial 
and operational status and compliance of the institution. 
The trend towards increasing reporting requirements, 
with more granularity and frequency and for both local 
and extra-territorial regulations, is a key challenge for 
financial institutions. Unstructured data, difficulties in 
tracking data sources and ineffective risk data calculation 
are also key challenges. Cloud-based and Al-powered 
Regtech solutions can help to automate and streamline 
regulatory reporting processes to improve reporting 
timeliness, accuracy and effectiveness, thus reducing 
risks and costs. 


The Common Reporting Standard (CRS) and the 
Foreign Account Tax Compliance Act (FATCA) 
have changed the tax information reporting landscape 
worldwide. CRS calls for the automatic exchange of 
information obtained from financial institutions between 
more than 100 jurisdictions, while FATCA requires foreign 
financial institutions to report on the assets held in their 


US clients’ accounts. Some financial institutions are 
facing challenges in managing the increased reporting, 
information gathering and compliance requirements 
across jurisdictions and, in general, the volume and 
quality of data involved. Regtech solutions can help to 
reduce the costs associated with granular reporting, 
and can enhance customer due diligence processes 
related to the identification of clients’ accounts under 
CRS and FATCA requirements. 


Tax compliance with respective rules and ensuring 
timely and accurate tax payments is an area of 
increasing regulatory focus. The varying reporting rules 
for operational taxes, and the rules and process-driven 
nature of tax compliance and reporting make these 
areas suited to Regtech solutions. These solutions, 
powered by underpinning technologies such as cloud, 
Al and machine learning, can help by automating tax 
compliance processes which can reduce costs and time 
spent on manually updating spreadsheets and reports. 
Effective automation can also help deliver value by 
freeing up time for the tax function to focus more on 
value-added strategic and business advisory activities. 


Risk management 


Cyber risk management refers to risks that can lead to 
financial loss, disruption or damage to an institution as a 
result of IT system failures. 





The increasing sophistication and scale of cyberattacks 
has increased the potential consequences of these 
threats to the banking sector. As banks become 
increasingly digital, it is important for potential Regtech 
solutions to protect data, systems and broader business 
activities from cyber risk. There are Regtech solutions 
being developed in the area of Al to combat these 
risks. Behavioural information captured from human 
touchpoints at various parts of a system or application 
could be analysed to detect for anomalous activities 
in a timely manner. For example, a person’s typing 
speed, finger position and finger pressure could be 
analysed to determine whether an unauthorised person 
is attempting to hack into a customer's account. As 
both synthetic and real-world training data sets become 
more readily available for machine learning, the viability 
and reliability of these Regtech solutions could increase. 


Third-party monitoring and risk management 
(TPRM) 
performance and service quality, and managing the risks 


refers to the monitoring of third-party 


presented throughout the lifecycle of the relationship. 
Hong Kong's banking value chain has increased in 
complexity driven by the rapidly expanding ecosystem 
of banks, technology and data providers, and other 
vendors, together with the introduction of virtual banks 
and an Open API Framework in Hong Kong. Banks are 
therefore increasingly exposed to third-party risks and 
will benefit from TPRM-related technologies. These 
solutions typically collect data from a variety of sources, 
analyse key indicators to generate risk scores, and 
provide a portfolio management view of third-party 
relationships. These tools can improve accuracy and 
reduce the cost of TPRM activities. 


Liquidity risk management involves measuring, 
monitoring and controlling the liquidity of financial 
institutions to ensure they have funds to meet 
obligations. There are platform solutions available 
that enable financial institutions to manage enterprise 
assets and liabilities, with functionalities to manage 
liquidity risk, interest rate risk, funds transfer pricing 
and regulatory compliance. They allow management 
to optimise liquidity across business units to meet 
business objectives while ensuring compliance with 
regulatory and internal policies. The high degree of data 
involved in such calculations makes it an attractive area 
for Regtech. 
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Market risk management refers to systems and 
processes that identify, measure, monitor and control 
exposure and risk of losses arising from movements 
in market prices (e.g. interest rate risk, credit spread 
risk, equity risk). The nature of banks’ business models 
means that prudent management of market risk is 
crucial to their performance and financial soundness. 
Technology solutions can help banks more efficiently 
and effectively manage market risk and produce 
management reports. 


Credit 
assessments 


risk assessment involves a series of 
relating to the process of credit 
underwriting and ongoing monitoring, including 
the analysis of financial information, verification of 
documents and review of news related to the borrower. 
This traditionally requires labour-intensive manual 
processes that prolong the credit assessment process. 
Regtech solutions that utilise Al and machine learning 
seek to overcome these challenges, enabling quicker 
assessments, greater accuracy and lower costs to the 
business. For example, in the process of personal loan 
application, instead of collecting income proof from 
borrowers, batches of data detailing their relevant 
attributes can be used to train Supervised Machine 
Learning models to estimate income and inform credit 
underwriting decisions. In the area of corporate lending, 
OCR technology can be used to convert financial 
statements into a machine-readable format, and the 
overlay of computational and extraction engines can 


generate key indicators to facilitate credit analysis. 


Stress testing is a technique to assess and analyse 
a financial institution’s potential vulnerabilities (e.g. 
profitability, liquidity and capital adequacy) to stressed 
conditions. Its process can be resource-intensive. 
Technology solutions are often underpinned by an 
Economic Scenario Generator module that generates 
values for an array of parameters, simulating potential 
stress scenarios. This is then applied to the specific 
financial circumstances of the institution to project its 
business over a period of time. This equips management 
with a better understanding of the financial risks faced 
by the business, and enables them to make informed 
strategic decisions that balance profitability, liquidity 
and capital adequacy. 
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e Model validation refers to a financial institution's 
processes that validate the accuracy and consistency 
of internal models by parties that are suitably qualified 
and experienced, and independent of the business 
functions involved in the development and usage 
of the internal models. For banks, model validation 
typically applies to models that relate to credit risk, 
market risk, liquidity risk and capital management. 
However, the scope of model validation is increasing 
as banks and regulators recognise that models are 
being used across the business, for example in the 
investment sales process to assess customers’ risk 
appetite. Model validation solutions typically capture 
data inputs, followed by a validation process involving a 
combination of quantitative (e.g. model, variables, back- 
testing) and qualitative (e.g. data quality, consistency) 
analysis, and finally generate reports and dashboards 
for management. 


Governance & accountability 


e Governance and accountability refers to the structure 
of rules, practices, processes and responsibilities 
within an organisation. Industry challenges arise 
where reactive risk identification processes lead to 
control gaps not being proactively managed, and 
insufficient data leads to poor visibility of issues. There 
are opportunities for Regtech solutions to transform 
traditional governance and accountability frameworks 
from reactive to proactive. For example, the use of GRC 
and other data-driven tools and dashboards can help 
to provide a transparent view of responsibilities and 
enable enhanced real-time monitoring of activities. 
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3.1 Current state of the 
Regtech industry in Hong 
Kong 


Notable progress in facilitating Regtech adoption has 
been made in Hong Kong in recent years, and there are 
significant opportunities to realise the benefits of more 


widespread Regtech adoption. 


ee 





A number of developments and initiatives to encourage 
the development of fintech in Hong Kong in recent years 
have also helped accelerate the development of Regtech. 
For example, the establishment of the Fintech Facilitation 
Office (FFO), the HKMA’s Seven Smart Banking initiatives, 
the Hong Kong SAR Government's R&D tax credits, and 
the provision of dedicated innovation zones such as Hong 
Kong Science and Technology Parks and Cyberport, have 
been key catalysts for fintech and Regtech development. 
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As a result, Hong Kong is now home to four fintech 
unicorns’. More specifically, Regtech development in 
Hong Kong has benefitted from the HKMA's Banking Made 
Easy initiative as well as the establishment of the FinTech 
Association of Hong Kong. 


Recent developments driven by the HKMA 
have been warmly received by banks and 
Regtech companies 


Both banks and Regtech companies have welcomed 
the HKMA's ongoing initiatives to expand the Regtech 
ecosystem under the Banking Made Easy initiative and 
encourage the wider use of Regtech. 


Fintech Supervisory Sandbox: Launched by the HKMA 
in September 2016, the Fintech Supervisory Sandbox 
(FSS)'° allows banks and their technology partners to pilot 
their fintech initiatives to a limited number of participating 
customers without subjecting them to the full scope of 
compliance with the HKMA's supervisory requirements. 


The FSS was upgraded to FSS 2.0 in 2017 to allow tech 
companies to access the Sandbox without needing to 
go through a bank. FSS 2.0 also introduced a single 
access point for all three financial services sandboxes in 
Hong Kong (HKMA, Securities and Futures Commission, 
Insurance Authority), as well as a Fintech Supervisory 
Chatroom (Chatroom) that provides feedback to banks and 
tech companies at an early stage of their fintech projects. 
The HKMA has highlighted that both the FSS and the 
Chatroom are open to Regtech initiatives and ideas. 


As at 31 July 2020, 48% of the 162 pilot trials within the 
Sandbox and about 22% of all enquiries in the Chatroom 
were related to Regtech (Figure 5). The HKMA also 
participates in the cross-jurisdiction piloting of solutions as 
part of the Global Financial Innovation Network’s (GFIN) 
group of regulators". 


Figure 5: Distribution of technologies involved in HKMA Fintech Supervisory Sandbox pilot trials (as of 31 July 2020) 





Source: HKMA Fintech Supervisory Sandbox 





^ Airwallex, BitMex, TNG and WeLab 
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| Others (e.g. notification service via social media platforms) 


10 Fintech Supervisory Sandbox, Hong Kong Monetary Authority, https://www.hkma.gov.hk/eng/key-functions/international-financial-centre/fintech/fintech-supervisory-sandbox-fss/ 
" Next steps of GFIN cross-border testing pilot, Hong Kong Monetary Authority (April 2019), https://www.hkma.gov.hk/eng/news-and-media/press-releases/2019/04/20190430-11/ 
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Regtech Watch: “Regtech Watch"'? is a newsletter 
published by the HKMA to promote the adoption of 
Regtech in the banking industry. It provides information on 
actual or potential Regtech use cases rolled out or being 
explored in Hong Kong or elsewhere. The objective is to 
assist banks in adopting innovative technology to enhance 
their risk management and regulatory compliance. Four 
issues of Regtech Watch have been issued since its launch 
in November 2019, covering cyber risk management, credit 
risk management, AML/CFT measures and conduct risk 
management. These newsletters were cited as a welcome 
development and a useful source of information and 
guidance by the interviewed banks. 


Regtech circulars and events: The HKMA‘s recent 
issuance of circulars related to Regtech (e.g. regulatory 
individual 
customers’? and corporate customers", and feedback 
on AML/CFT control 
on-boarding initiatives based on thematic reviews") has 


expectations for remote on-boarding of 


measures for remote customer 


been well received by many banks. Furthermore, events 
such as the HKMA AML/CFT RegTech Forum held in 
November 2019 have generated positive sentiment from 
the industry and have helped to draw attention to AML/ 
CFT as a key area of Regtech application. One of the 
primary objectives of the AML/CFT RegTech Forum was 
to bring together different stakeholders in the AML/CFT 
ecosystem, including the banking sector and experts in the 
technology field to increase the collective understanding 
of industry pain points, what technologies are capable of 
today, and the challenges that need to be addressed for the 
successful adoption of such tools. The event also served 
as an agent to drive change, with the HKMA looking to 
continue to bring sectors together and identify concrete 
opportunities for banks to adopt Regtech solutions'®. 


Launch of virtual banks: The HKMA's granting of eight 
virtual bank licences’? in 2019 is seen as a positive 
milestone for Regtech adoption. The revised Guideline 
on Authorization of Virtual Banks was 
May 2018 as a key component of the HKMA's Smart 
Banking initiatives. The amended Guideline supersedes 
the previous Guideline first issued by the HKMA in May 
2000 and its subsequent update in September 2012. 
The revised Guideline aims to promote the adoption of 
new technology, enhance customer experience and drive 


introduced in 


financial inclusion in the city. 





The absence of legacy infrastructure and physical 
branches means that virtual banks can make greater 
use of new technologies, including Regtech, to offer 
functionalities such as remote on-boarding. The successful 
implementation of technologies has 
traditional financial institutions what can be achieved and 
has increased industry awareness and interest in Regtech. 
The successful introduction of virtual banks in Hong Kong 
is leading to similar initiatives being adopted in other 


such shown 


jurisdictions in the region such as Singapore and Malaysia. 


Fintech events: The HKMA continues to reach out to and 
liaise with fintech market players to facilitate the exchange 
of ideas among stakeholders. It has also organised events 
in collaboration with the fintech community. By the end of 
August 2020, it had organised 60 events attracting over 
30,000 participants in all. The HKMA has also spoken 
at fintech-related events and held meetings with other 
regulatory authorities, industry organisations, financial 
institutions, technology firms and start-ups. The events, 
speaking sessions and meetings were well received by 
the industry. 


The FinTech Association of Hong Kong 
plays a key role in the ecosystem 


Established in June 2017, the FinTech Association of Hong 
Kong aims to champion an open, inclusive and diverse 
fintech community in Hong Kong. The association seeks 
to collaborate with all stakeholders in the fintech industry, 
including working with regulators to promote the adoption 
of technology and to further develop the ecosystem. 


The association has three primary objectives: advocate 
via a unified voice for the Hong Kong fintech ecosystem, 
collaborate by bringing together the diverse parts of the 
community, and educate by learning from existing leaders 
and nurture the next generation of talent. The association is 
reported to be one of the most active fintech associations 
in the world with more than 1,700 members'®, of which 
more than 200 are corporate members from a diverse 
range of backgrounds’’. 


A Regtech Committee was formed within the association 
to foster the development of the Regtech ecosystem 
in Hong Kong. The committee continues to collaborate 
with other associations and industry stakeholders and 


12 Inaugural Issue of Regtech Watch, Hong Kong Monetary Authority (November 2019), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2019/20191112e1.pdf 
18 Remote on-boarding of individual customers, Hong Kong Monetary Authority (February 2019), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 


circular/2019/20190201 e1.pdf 


1 Remote on-boarding of corporate customers, Hong Kong Monetary Authority (September 2020), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 


circular/2020/20200924e1.pdf 


15 Feedback from thematic review of AML/CFT control measures for remote customer on-boarding initiatives, Hong Kong Monetary Authority (June 2020), https://www.hkma.gov.hk/media/eng/ 


doc/key-information/guidelines-and-circular/2020/20200603e1.pdf 


16 HKMA AML/CFT RegTech Forum: Record of Discussion, Hong Kong Monetary Authority (December 2019), https:/Awww.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 


circular/2019/20191223e1a1.pdf 


17 Virtual Banks, Hong Kong Monetary Authority, https://www.hkma.gov.hk/eng/key-functions/banking/banking-regulatory-and-supervisory-regime/virtual-banks/ 
18 FinTech Association of Hong Kong Elects New Leadership, Finextra (July 2020), https:/Awww.finextra.com/pressarticle/833 15/fintech-association-of-hong-kong-elects-new-leadership 





19 Membership Directory, Fintech Association of Hong Kong, https://ftahk.org/memberdirectory 
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has hosted multiple Regtech live events showcasing 
demonstrations of award-winning Regtech companies. It 
was ranked as one of the top three committees delivering 
the most value for their members”. 


In addition, the RegTech Association of Hong Kong, an 
independent not-for-profit association, was launched in 
2019. It was formed by Regtech entrepreneurs to provide 
a stronger focus on Regtech across all regulated industries 
with an initial focus on financial services. Its initial focus 
is on raising awareness of the importance of Regtech. It 
has around 20 members, principally Regtech companies 
at present, and is looking to grow and attract financial 
institutions in the future. 


Hong Kong is home to both domestic and 
international Regtech companies 


Hong Kong is currently home to both domestic and 
international Regtech companies. Interviews for this study 
found that Hong Kong is currently more of an importer of 
Regtech solutions, with the majority of active providers 
headquartered overseas with varying degrees of local 
operations in Hong Kong. This is not surprising given that 
foreign bank branches typically follow practices driven 
by the head office in their home jurisdiction. Surveyed 
and interviewed banks also cited the maturity of Regtech 
solutions in jurisdictions such as the US, the UK and 
Australia as a key reason for deploying them for use in 
Hong Kong. Efforts to promote Regtech in Hong Kong need 
to address the needs of both domestic and international 
Regtech companies. 


Regtech companies are positive about 
opportunities in Hong Kong, but are 
concerned about the market size and talent 
supply 

Hong Kong is viewed as the top jurisdiction for expansion 
by surveyed Regtech respondents that do not currently 
have operations in Hong Kong. Furthermore, interviews 
suggest that a number of foreign Regtech firms that are 
currently not operating in Hong Kong would consider 
entering the market if the right opportunities arise. 


Limited market size, cost of talent and a shortage of 
suitable talent were cited by Regtech firms as key reasons 
for not operating in Hong Kong. ‘Sales and marketing’, 
‘software developers’ and ‘data scientists’ were identified 
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by surveyed Regtech firms as the top three areas of talent 
shortage. It is apparent that while a large portion of Regtech 
firms operating in Hong Kong only deploy client facing staff 
for sales and account management, some players are also 
seeking to build solution development teams in Hong Kong 
but are finding it difficult to find the right talent. 


Figure 6: Top 5 countries/ territories where respondents do 
not currently operate in but expect to be active in five years’ 
time 


Ranking  Country/ territory 
Hong Kong SAR 
United States 


Mainland China 


Singapore 


Australia/ United Kingdom 





Source: HKMA Regtech Survey for Regtech Companies, KPMG 
analysis 


Current state of Regtech 
adoption by banks in Hong 
Kong 


32% of survey respondents have fully implemented at 
least one Regtech solution; greater opportunities for 
adoption among smaller institutions and foreign bank 


branches. 


Our survey of banks in Hong Kong finds that the level of 
Regtech adoption varies across the industry (Figure 7). 
32% of respondents have fully implemented at least one 
Regtech solution, while a further 37% are in the process of 
vendor selection or proof of concept (POC) development. 
It is perhaps unsurprising that the survey found that the 
virtual banks are further along their journey with regard to 
Regtech adoption, as the digital nature of their business 
models and infrastructure is geared towards Regtech 
adoption. Private banks and wealth managers are also quite 
advanced in their Regtech uptake, with 75% using, trialling 
or selecting Regtech solutions. 
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The survey also shows that banks with larger asset sizes 
are more likely to have fully implemented or are developing 
POCs for Regtech solutions. For example, 69% of all 
surveyed banks have either fully implemented solutions, 
are developing POCs or are selecting vendors/ options, 
compared to 92% of surveyed banks with assets greater 
than HKD 100 billion. In addition, respondents that are 
headquartered in the Americas, EMEA and Mainland China 
are more advanced in implementing Regtech solutions. 


On the other end of the spectrum, 32% of respondents 
note that they do not currently utilise Regtech solutions. 
The majority of this group are smaller banks (generally 
with assets less than HKD 100 billion) and banks that are 
headquartered in the rest of Asia (excluding Mainland 


China and Hong Kong). More than half of the surveyed 
banks with total assets under HKD 10 billion have not yet 
implemented any Regtech projects. 


The findings indicate a clear opportunity to pursue greater 
Regtech adoption in Hong Kong, not just among the 
respondents that are yet to utilise or are considering 
Regtech solutions, but also for those that are at the POC 
stage. Even for the respondents that have implemented 
at least one Regtech solution, the 26 application areas 
outlined in Section 2.4 suggest that there is significant 
potential for those banks to explore more solutions. The 
different needs of these groups need to be carefully 
considered in order to promote wider adoption. 


Figure 7: Breakdown of respondents’ current state of Regtech implementation in Hong Kong 


All respondents 


Virtual 
Bank 


< HKD 10 
billion 





All banks Americas 


Banks with assets 
>HKD 100 billion 


I Not implemented 


Note: Numbers may not add up to 100% due to rounding 


Source: HKMA Regtech Survey for Authorized Institutions, KPMG analysis 
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Use case maturity in Hong Kong 


Financial crime-related use cases are those with 
the most mature solutions in Hong Kong, while 
opportunities exist for new solutions in more emerging 


areas. 


Our survey of banks indicates a wide range of Regtech use 
cases within the banking industry in Hong Kong, with at 
least one respondent currently using a Regtech solution in 
each of the 26 identified use cases in the survey. However, 
the maturity of solutions and attitudes and awareness vary 
significantly across use cases. 


Financial crime-related solutions are 
considered the most mature 


Financial crime compliance and KYC solutions are viewed 
as the most mature, with a large portion of surveyed 
banks currently using or implementing Regtech in these 
areas (Figure 8). These include name screening (62% 
of banks), AML transaction monitoring (54% of banks), 
customer on-boarding (including KYC/ background checks, 
47% of banks) and ongoing monitoring of customer 
activity (37% of banks). This is understandable given the 
significant regulatory focus and volume of activities driven 
by regulators in Hong Kong and other jurisdictions in the 
past few years. 


The next group of common existing application areas 
relates to regulatory reporting (32% of banks) and other 
risk management areas, including credit risk (82% of 
banks), market risk (30% of banks), cyber risk (28% 
of banks) and liquidity risk (27% of banks). Banks with 
varying asset sizes, and presumably resources, have 
different adoption maturity in these areas. Larger banks are 
generally more mature with regard to Regtech adoption, 
while smaller banks tend to view regulatory reporting and 
risk management as areas to adopt Regtech solutions in 
the future. 


Other emerging areas where there are fewer use cases 
but significant interest in future adoption include GRC tools 
(helos maintain and manage a repository of regulations 
to ensure compliance requirements are met), TPRM, 
stress testing for capital management and conduct-related 
areas (for example, sales practices, product suitability and 
disclosures). The smaller banks surveyed tend to consider 
Regtech for fulfilling compliance requirements, while the 
larger banks are focusing on product-related matters (e.g. 
product disclosure). 


Some solutions need to mature further for 
the Hong Kong environment 


Although there is significant demand for solutions across a 
range of areas, the survey indicates that relevant existing 
solutions in Hong Kong will need to become more mature 
before there can be greater adoption. The top three areas 
where solutions were not considered mature enough 
include operational resilience from regulatory change, 
regulatory horizon scanning and product due diligence. 
Although in many cases the solutions are not mature 
enough globally, this suggests areas where greater efforts 
are needed to promote solution development. 


Some solutions are specific to certain 
business models 


Other emerging areas are more localised to specific 
segments of the industry. For example, banks operating 
in the private wealth management industry place a high 
priority on sales practices and product suitability, with 
75% of surveyed respondents either already using or 
considering adopting Regtech solutions. Segmenting 
the industry by total asset size also reveals that larger 
banks tend to prioritise product disclosure quite highly as 
compared to smaller banks, with half of the surveyed large 
banks (total assets greater than HKD 250 billion) citing this 
as an area being considered for future Regtech adoption. 
This is partly attributable to their more retail and private 
bank focus. Within the virtual bank segment, there is more 
active adoption of Regtech. All surveyed virtual banks are 
either already using or in the process of implementing 
Regtech for on-boarding. 80% of respondents are using 
or implementing Regtech for AML transaction monitoring, 
ongoing monitoring of customers and name screening. 


‘Not suitable’ responses indicate a lack of 
need or awareness 


20% of survey respondents felt that Regtech was not 
appropriate across the application areas. This may be 
indicative of the specific scale and business model of the 
institution. For example, 37% of surveyed banks with total 
assets less than HKD 10 billion did not see cross-border 
regulatory compliance as an appropriate area for Regtech. 
Alternatively, this may indicate a lack of awareness of 
solutions because, as evidenced by the respondents that 
have implemented Regtech solutions, there are genuine 
use Cases across all categories. 
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Figure 8: Respondents’ current usage/ views on technology used in complying with banking regulations and risk 
management standards in Hong Kong 








Name screening 62% 23% 8% 6% 
AML transaction monitoring 54% 30% 10% 6% 
Customer on-boarding 47% 32% 13% 8% 
Ongoing monitoring of customers 37% 43% 12% 8% 
Credit risk assessment 32% 37% 12% 19% 
Regulatory reporting 
Market risk management 
Cyber risk management 
Liquidity risk management 
Customer data and privacy 
Monitoring and surveillance of employees 
CRS/ FATCA 
Stress testing 19% 46% 15% 20% 
Best execution/ pricing 17% 32% 24% 27% 
Third-party monitoring and risk management 17% 45% 23% 15% 
Sales practices and suitability ZS 37% 20% 29% 
Customer off-boarding EA 35% 19% 32% 
Model validation 
eo 
Cross-border regulatory compliance 
Product due diligence 
Product disclosure 
Tax compliance 
Governance and accountability 
Regulatory horizon scanning WAG 44% 25% 24% 
Operational resilience from regulatory change EWA 41% 28% 26% 
I Currently using or BB Considering to use BB Solutions are not mature J Regtech is not appropriate 
implementing it in the future enough yet in Hong Kong for this area 


Source: HKMA Regtech Survey for Authorized Institutions, KPMG analysis 
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Use cases can be prioritised based on 
maturity 


The use cases can be categorised according to three broad 
categories (Figure 9): 


e Ready now: This includes solutions such as name 
screening, AML transaction monitoring and customer 
on-boarding. Depending on business needs, it can be 
a ‘no regrets’ decision for banks to implement and 
execute with proven solutions and case studies. 


e Prepare to implement: These are solutions that may 
have been viewed by respondents as less mature than 


Figure 9: Prioritisation of risk and compliance application areas 
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Source: HKMA Regtech Survey for Authorized Institutions, KPMG analysis 
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those in the first category, but are worthy of serious 
effort and consideration to implement. It includes 
maintaining inventory of all internal and external 
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Monitoring and POCs: This represents the solutions 
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3.2 Regtech adoption 
challenges 


Budgetary and capability constraints, as well as the 
lack of availability and maturity of solutions are the 
main adoption challenges for banks and Regtech 


providers. 


‘Budget and resourcing constraints’ is the 
primary barrier 


‘Budget and resourcing constraints or unattractive business 
case’ was highlighted by 75% of surveyed banks as 
a ‘top five’ barrier to Regtech adoption, with banks 
often allocating resources elsewhere (Figure 10). Revenue 
generating drivers that contribute to both top and bottom- 
line growth are typically viewed as a higher priority than 
initiatives where the potential benefits are perceived as 
more conceptual and difficult to quantify. Furthermore, 
it can be challenging to fit what can be perceived as 
discretionary spend into annual budgetary cycles. 


As a result, it is observed that funding for technology 
solutions related to risk management and compliance 
activities is often not a priority. 


This trend is more evident among the smaller banks. Our 
survey finds that there is an inverse relationship between 
the percentage of banks that ranked budget and resourcing 
constraints as their top adoption challenge, and their total 
assets. Banks with assets greater than HKD 500 billion are 
the exception, as they often have to manage a number of 
competing priorities that are associated with a large and 
more diversified financial institution. Interviews with banks 
found that even within the Regtech domain itself, there 
are often competing priorities across different divisions 
and functions. 


The current business environment has made cost 
management a primary area of focus for the industry. There 
are opportunities for banks to adopt Regtech solutions to 
help reduce costs related to their risk management and 
compliance activities. 


Figure 10: Barriers to adopting Regtech solutions that banks ranked as a top 5 challenge 


Budget or resource constraints and prioritised 
elsewhere/ unattractive business case 


Lack of available solutions/ maturity of 
solutions do not meet needs 


Lack of suitably skilled/ experienced talent to develop 
and/ or implement successfully 


Concern over risk in case the solution fails 


Data is not in a form that can be easily digitised 


Complex legacy infrastructure renders solution 
development and implementation challenging 


Reluctance/ challenges around aligning decisions 
globally or regionally rather than locally 


Restrictions in group policies/ risk appetite 


Lack of sufficient local vendor support to implement 


Solutions do not meet local regulatory/ language 
requirements 


Fear over loss of control of compliance/ third party risk 


Unsure whether regulators would approve solutions 
Vendors lack track record and fail to meet 
on-boarding policy requirements 


Perceptions that Regtech will lead to headcount 
reductions 


Source: HKMA Regtech Survey for Authorized Institutions, KPMG analysis 
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Lack of availability and maturity of solutions 
a significant obstacle 


47% of surveyed banks noted that a lack of available and 
mature solutions in Hong Kong remains a key challenge 
to Regtech adoption, the second ranked barrier overall. 
Importantly, this finding indicates that while some banks 
may be facing budgetary and resource constraints, there 
is certainly interest in exploring and investing in Regtech 
solutions if they are fit for purpose. 74% of the surveyed 
banks expressed an open attitude towards the future 
adoption of Regtech solutions, citing that Regtech will play 
an important role in the industry and can bring benefits such 
as improved efficiency, a reduction in manual processes 
and enhanced internal controls and risk management. 


Interviews with banks found that a common issue arises 
when Regtech firms approach banks with a solution before 
assessing or understanding the actual pain points that the 
banks are facing. For example, some Regtech solutions 
did not adequately address local regulatory requirements, 
while others were not suitable for the bank's specific 
business or operational circumstances and setup. This may 
reflect the fact that some Regtech providers present in 
Hong Kong offer global solutions that may not have tailored 
solutions to meet the needs of the Hong Kong regulatory 
environment. 


Talent shortages are hindering Regtech 
development 


‘Lack of suitably skilled/ experienced talent to develop 
and/ or implement successfully’ is highlighted by 44% 
of surveyed banks as a key barrier to Regtech adoption. 
Several interviewed banks noted that they aim to recruit 
talent with skill sets from multiple disciplines (e.g. regulatory 
compliance, technical programming/ data analytics and 
business domain) and highlighted the importance of 
experience in the field. This barrier is more commonly 
cited by locally incorporated banks, as they tend to source 
their talent from the local market. The survey and interview 
findings therefore indicate that while Regtech solutions 
need to further mature, suitable talent also needs to be 
nurtured to facilitate greater Regtech adoption in Hong 
Kong. 


Concerns remain about the associated risks 
if a solution fails 


40% of surveyed banks ranked ‘concern over risk in 
case the solutions fails’ as one of their top five barriers 
to adopting Regtech. As Regtech is still a relatively new 


area of exploration, several banks continue to follow a 
more cautious approach to localised adoption and are 
closely monitoring the adoption strategies of their peers. 
Interviews with banks revealed that greater awareness of 
successful cases and guidance would help to overcome 
this barrier. 


This barrier is particularly evident among smaller banks 
(asset size of less than HKD 100 billion). However, some 
interviewed Regtech providers noted that it is often easier 
to market their solutions to smaller banks due to the 
relative ease in adopting Regtech as compared to larger 
banks that may have more complex infrastructure and 
processes. 


Lack of awareness of potential benefits 


40% of surveyed banks noted that a lack of awareness 
or potential value of Regtech solutions was another key 
barrier to Regtech adoption. This indicates that banks are 
interested in harnessing suitable Regtech solutions, but 
more needs to be done to communicate the available 
solutions in the market and the potential benefits they can 
bring. 


Specifically, a few interviewed banks cited that Board 
members and senior management, as well as middle 
management, are often blockers for Regtech solutions as 
they do not fully understand the potential benefits. Given 
the increased focus on cost management, there is a need 
to place greater emphasis on communicating the cost 
benefits of Regtech solutions. 


Other commonly cited Regtech adoption 
challenges vary depending on the bank's 
size and place of incorporation 


Larger banks face significant challenges around data 
readiness and legacy infrastructure. For some financial 
institutions, the practice of bolting on new platforms 
or system upgrades without addressing legacy issues 
has created a complex network of systems and data 
architecture. This can require a significant amount of time 
and resources to address before certain Regtech solutions 
can be fully and effectively implemented. 


Meanwhile, the survey finds that smaller banks are 
grappling with a lack of awareness of Regtech solutions 
and their benefits, as well as talent shortages. It is therefore 
essential to increase awareness among different groups 
within financial institutions, including senior management, 
risk and compliance, IT and business unit management. 
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Many locally incorporated banks also cited the lack of 
suitable talent as a key adoption challenge. The shortage 
of talent, particularly around business domain knowledge, 
working knowledge of regulatory requirements and 
technology domain knowledge and skills, also needs to 
be addressed. This applies to both local and international 
talent. 


In addition, interviews with banks incorporated overseas 
(or foreign branches) found that obtaining alignment and 
approval from the head office for locally initiated Regtech 
initiatives remains a challenge. Since many international 
financial institutions follow a centralised model for their 
strategic technology initiatives, selection and deployment 
of Regtech solutions tend to be driven globally from the 
head office. This means that foreign branches in Hong 


Kong often have limited input or involvement in the 
analysis, evaluation and selection of Regtech solutions prior 
to their implementation locally. Interviewees highlighted 
several localisation issues that can therefore surface during 
implementation, such as regulatory incompatibility and 
unsupported languages or dialects. 


Regtech providers’ prioritisation was broadly 
similar to that of banks 


Banks and Regtech providers agree that budgetary 
concerns are the number one constraint (Figure 11), with 
similar positioning for lack of awareness of potential value 
(5th for banks and 2nd for Regtech providers respectively), 
data not being in a form that can be easily digitised (6th and 
6th respectively), and banks’ restrictions in group policies/ 
risk appetite (9th and 8th respectively). 


Figure 11: Relative ranking” of Regtech adoption barriers by type of respondent 


Barriers to Regtech adoption 


Regtech 
Providers* 


Budget or resource constraints are prioritised elsewhere/ unattractive 


business case (e.g. not enough scale) 


Lack of available solutions/ maturity of solutions do not meet needs 
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There was also similar positioning for lower-ranked barriers 
across both groups of respondents, such as banks’ fear of 
headcount reduction. 


Indications that Regtech providers need to 
focus more on pain points, localisation and 
vendor support 


Bank respondents view the lack of available or mature 
solutions as the second most important barrier to adoption, 
compared to ninth for Regtech providers. This was supported 
by interviews with banks that suggested technology firms 
often approach banks with a Regtech solution without a 
complete understanding of the actual pain points that they 
face. On the other hand, interviewed Regtech providers 
noted that a key challenge to Regtech adoption relates 
to difficulties in gaining traction with banks in Hong Kong 
due to the latter’s preference for more mature solutions 
and an established track record. There is a similar, yet less 
prominent, divergence between the degree of localisation 
to local language and regulatory requirements (banks rank 
11th and Regtech providers 15th) and level of local vendor 
support (10th and 14th respectively). This difference 
suggests the need for Regtech providers to focus more 
on these areas in order to drive greater Regtech adoption. 


Regulatory concerns feature 
prominently for Regtech providers 


more 


Regtech providers cite greater concern than banks over 
whether regulators would approve solutions. This could 
partly reflect the international nature of the respondent 
group or reasons given by banks for not pursuing 
conversations further. Although regulators will not endorse 
specific solutions, greater engagement leveraging the 
active use of the FSS and the Chatroom may provide 
Regtech providers with early supervisory feedback and 
more confidence in rolling out new initiatives. 





3.3 Lessons from other 
markets 


Other markets are showing momentum in Regtech 
adoption as they adopted early, follow integrated 


approaches and provide financial incentives. 


As part of this white paper, three jurisdictions were 
approached for better understanding of the progress made 
and lessons learnt in promoting Regtech adoption. 


Australia 


Australia benefits from a strong and independent Regtech 
association as well as clear guidance from the regulator on 
which use cases to prioritise and adopt. Coordinating with 
other Australian financial services regulators, the Australian 
Securities and Investments Commission (ASIC) has taken a 
leading role in driving Regtech development and adoption 
within the sector. ASIC pursues the promotion of Regtech 
adoption as a key strategic priority via its Innovation Hub 
by engaging with the Regtech industry on policies and 
perspectives, and promoting Australia as a world-class 
Regtech developer and adopter”. 


ASIC received federal government funding for financial 
years (FY) 2018-19 and 2019-20 to promote Australia as a 
world leader in developing and adopting Regtech solutions 
for risk management and compliance problems relating to 
financial services”. Building on its existing engagement and 
collaboration approach to promoting the potential benefits 
of Regtech to financial institutions, the funding was used 
to develop a series of Regtech initiatives. Focusing on 
the most challenging and impactful regulatory issues, the 
“ASIC Regtech Initiative Series” examines the potential 
of Regtech solutions that are in the developmental phase 
rather than mature services. 


The four initiatives set out in the FY2018-19 series included 
‘Monitoring financial promotions’, ‘Financial advice files’, 
‘Voice analytics and voice-to-text’ and ‘Technology-Assisted 
Guidance (TAG) tool’. These topic areas were chosen 
after consultations with stakeholder groups highlighted 
the potential for Regtech to deliver better monitoring and 
compliance outcomes for a fairer and stronger market for 
consumers. 


21 Innovation Hub, Australian Securities and Investments Commission (2020), https://asic.gov.au/for-business/innovation-hub/ 
22 ASIC and Regtech, Australian Securities and Investments Commission, https://asic.gov.au/forbusiness/innovation-hub/asic-and-regtech/ 
23 ASIC regtech initiative series 2018-19, Australian Securities and Investments Commission (2019), https://asic.gov.au/forbusiness/innovation-hub/asic-and-regtech/asic-regtech-initiative- 


series-2018-19/ 
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An event was organised for each initiative, with specific 
problem statements for which Regtech solution providers 
were selected to demonstrate their solutions on curated 
data sets. 


This communication approach of clearly setting out 
initiatives with specific focus areas for the coming 12 to 
18 months allowed the industry to prepare and allocate 
funding and resources to the relevant areas with greater 
confidence. 


The RegTech Association is a non-profit association 
founded in March 2017 to support the growth and 
deployment of Regtech. With a membership base of 
over 120 local and international Regtech and corporate 
organisations, the association brings together regulators, 
regulated entities, Regtech providers and professional 
services firms to tackle industry issues, and promotes the 
adoption of Regtech via a series of events that involve 
guest speakers and presentations from Regtech firms. The 
association also hosts an annual RegTech Awards” with a 
diverse panel of 18 judges from banks, Regtech providers 
and government bodies. 


In its first few years of operation, the association has helped 
to foster greater collaboration and communication across 
the industry, including through relevant Regtech thought 
leadership, news, events and awards. This approach differs 
from Regtech associations in other jurisdictions in terms of 
its significant membership size and level of collaboration 
with regulators as a standalone Regtech association. 


Singapore 


The Singapore government and the Monetary Authority of 
Singapore (MAS) are actively collaborating with the industry 
to promote the use of Regtech solutions in Singapore. 


Data availability is the foundation for the ecosystem. In 
this regard, the government has taken the lead in allowing 
Regtech firms to access certain data sets to use in their 
solutions. This is the “Government-as-a-Service” model via 
the Smart Nation Initiative?®, where a single data strategy 
unifies data sources across government agencies through 
the Mylnfo service. This has allowed greater and more 
efficient access and use of trusted data by businesses, 
including financial institutions, and has enabled initiatives 





24 The RegTech Association, https://www.regtech.org.au/ 


such as SingPass Mobile’, a digital identity management 
system, to be used to open personal banking accounts. 
This helps banks to meet KYC requirements in an efficient, 
seamless and secure manner. 


The ecosystem is further enhanced by key partners 
including the Singapore FinTech Association (SFA). It has 
established a RegTech sub-committee with objectives that 
include: talent development; engagement with regulators; 
engagement with industry; and nurturing the development 
of both local and international Regtech companies. 


MAS and the SFA also collaborate to drive technology 
initiatives across the financial services sector. A number of 
interviewees suggested that MAS's visible involvement in 
the Regtech and broader fintech industry has helped to send 
a message to the financial services sector that embracing 
technology is a priority. This close collaboration has helped 
to enable rapid responses such as the establishment of 
the SGD 6 million MAS-SFA-AMTD FinTech Solidarity 
Grant to support Singapore-based fintech companies 
amid the challenging business climate caused by the 
COVID-19 pandemic”. The FinTech Compliance Readiness 
Framework and Self-Assessment Toolkit was also launched 
to enhance the compliance readiness of fintech solutions, 
and promote a safe and sustainable partnership between 
financial institutions and fintechs in Singapore. 


As a strong advocate of thought leadership in the Regtech 
domain, MAS and the Financial Stability Board (FSB) 
supported the Saudi G20 Presidency and the Bank for 
International Settlements (BIS) Innovation Hub Singapore 
Centre in conducting the inaugural G20 Global TechSprint 
in 2020 to examine the potential for new and innovative 
technologies to respond to operational challenges in the 
areas of Suptech (supervisory technology) and Regtech. 


MAS and the SFA also have a variety of funding schemes 
to accelerate technology adoption in the financial services 
sector. There are nine grants that target fintech solution 
development, adoption or establishment of a technology 
innovation hub in Singapore. Financial institutions and 
fintech firms in Singapore have tapped into these grants to 
implement Regtech projects. 


25 RegTech Awards 2020, The RegTech Association (2020), https://www.regtech.org.au/rta-awards-2020 
6 Initiatives, Smart Nation Singapore, https://www.smartnation.gov.sg/what-is-smart-nation/initiatives 


27 Singapore Personal Access, https://www.singpass.gov.sg/singpass/common/aboutus 


28 MAS-SFA-AMTD Fintech Solidarity Grant, Singapore Fintech Association (2020), https://singaporefintech.org/mas-sfa-amtd/ 
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Finally, MAS organises high-profile fintech events including 
the annual Singapore FinTech Festival (SFF)? and the MAS 
Global FinTech Innovation Challenge. The latter comprises 
two distinct competitions — the MAS Global FinTech 
Hackcelerator®? and the MAS FinTech Awards®! with a total 
cash prize of SGD 1.75 million and 15 awards being handed 
out each year that range from SGD 50,000 to SGD 150,000. 


UK 


The Financial Conduct Authority (FCA) was an early 
supporter of Regtech. It has promoted the development of 
the Regtech ecosystem through a variety of initiatives that 
communicate with the Regtech industry, advocate greater 
Regtech adoption and facilitate opportunities for the private 
sector to convene and overcome challenges. 


The FCA was a pioneer in the creation of a regulatory 
sandbox* in May 2016. Its sandbox has received over 440 
applications, and approximately 140 businesses across 
six cohorts have participated in testing their propositions. 
The FCA also chairs GFIN, and in 2019 led the launch of 
a global sandbox. The cross-border testing pilot allowed 
firms the opportunity to test their solutions with up to 
17 participating regulators, although most applicants only 
selected a few regulators to test with, as aligned with 
their respective business strategies. The pilot cohort saw 
44 applicants, most of which were in the earlier stages of 
development and smaller in scale. Eight were selected to 
proceed, of which three were selected to be tested with 
the HKMA. 


The FCA was also the first regulator to host a hackathon- 
style event that focused on Regtech in 2016, called 
TechSprint®*. It follows a now familiar format where 





29 Singapore Fintech Festival, https://www.fintechfestival.sg/ 
30 Global Fintech Hackcelerator, Singapore Fintech Festival (2020), https://www.fintechfestival.sg/global-fintech-hackcelerator 
31 MAS Fintech Awards, Singapore Fintech Festival (2020), https://www.fintechfestival.sg/fintech-awards 

32 Regulatory Sandbox, Financial Conduct Authority (July 2020), https:/Awww.fca.org.uk/firms/innovation/regulatory-sandbox 
33 TechSprints, Financial Conduct Authority (March 2020), https://www.fca.org.uk/firms/innovation/regtech/techsprints 


the industry is invited to enter project teams to develop 
technology solutions for specified problem statements 
in a set period of time, ranging from two days to two 
weeks. These events also often feature keynote speeches, 
discussion panels and networking sessions, drawing in a 
wide audience. 


The first TechSprint event focused on consumer access 
and involved 40 participants from 10 organisations. The 
FCA has since hosted seven TechSprint events spanning a 
variety of focus areas including financial services products 
to help consumers in vulnerable circumstances, such as 
those with mental health problems, model-driven machine 
executable regulatory reporting, AML and financial crime, 
and pensions. The scale of these events has varied 
depending on the topic, ranging from niche events with 
30 individual participants, to global events with 140 
participants from 40 organisations. 


The FCA recognises the difficulty in demonstrating the 
value of solutions and building convincing business cases 
in the absence of data. To help overcome this barrier, 
the FCA has launched a digital sandbox with a focus on 
providing synthetic data sets to enable the development of 
new solutions to challenges exacerbated by the COVID-19 
pandemic. It is expected to act as a public utility for a range 
of stakeholders, including incumbents, Regtech firms, 
technology providers, academics and regulators, to test 
technology solutions. 


The survey results, research findings and interview insights 
throughout this section — relating to the current state of the 
Regtech industry in Hong Kong, adoption challenges and 
lessons learnt from other markets — form a basis for the 
16 recommendations that are further explored in Section 5. 
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Regtech implementation 
common practice 


Laying the foundations 


4.1 Conceptual framework 


The potential uses of Regtech and its benefits presented in 
Section 2 show ample opportunities for all banks, but the 
array of adoption barriers discussed in Section 3 highlights 
some of the challenges that need to be overcome. A five- 
stage Regtech adoption process that helps banks navigate 
this journey could be considered: Identify, Create, Validate, 
Develop and Deploy (Figure 12). Each step builds on the 
last and the framework makes use of Design Thinking and 
Agile to bring in skills from across the organisation and 
develop robust solutions rapidly. 


Regtech providers can play a key role in implementation. 
This section also discusses key considerations for using 
external providers and five attributes of an effective 
partnership. 








There are three key components that form the foundation 
of the framework. 


1 Ownership: Clear ownership is needed over the 
implementation of Regtech. Surveyed banks most 
commonly cited the CEO as the key sponsor of Regtech 
solutions (Figure 13). This is understandable as the CEO 
has authority and a cross-functional purview. However, 
when implementing a solution, the composition of the 
Steering Committee at a bank needs to be carefully 
considered to ensure that there is appropriate and 
balanced representation from all impacted functions. 


2 Governance: The above shows the importance of 
having appropriate governance to ensure that projects 
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Figure 12: Regtech adoption process 
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Source: KPMG 


stay on track as they progress through each stage. Banks 
can build this into their existing project governance 
structures or use the above process as an example. 


3 Capabilities: |t is important to ensure that the bank has 
hired or developed the right technical capabilities in order 
to implement effectively. This is important regardless of 
whether the solution is developed in-house or sourced 
externally. 


Identify opportunities 


The first stage begins with identifying opportunities from 
across the institution. This involves identifying regulatory, 
risk and compliance pain points and improvement areas, 
and defining a problem statement. These can then be 
prioritised based on factors such as the current strategic 


VALIDATE 


concepts 





Design thinking approach bringing in skills from across the Firm and Ecosystem to address opportunities 
The Agile approach brings speed to the market and more robust solutions. 


DEVELOP DEPLOY 


working to realise 
solutions ’ value 


— 


focus of the organisation (growth, cost or risk mitigation), 
initial views of the scale of the benefit and the cost 
and maturity of the available solutions. Benefits can 
be challenging to measure, but conducting a high-level 
comparative analysis to directionally differentiate between 
opportunities is sufficient at this stage. For example, 
benefits can be identified, mapped and assessed based 
on whether they are financial or non-financial, and whether 
they are quantifiable or non-quantifiable. 


Create potential concepts 


The next stage is to create potential concepts, which may 
involve external technology providers. To assist with the 
sourcing of external providers, there are solutions in the 
market that provide matching services based on defined 
problem statements. 


Figure 13: Primary sponsor of Regtech solution implementation at surveyed banks 
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Source: HKMA Regtech Survey for Authorized Institutions, KPMG analysis 
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The key here is to develop high-level designs and resourcing 
estimates for development, testing and launch in order to 
provide input into high-level business cases. This allows for 
an initial assessment of feasibility and prioritisation before 
continuing to the next stage. 


Validate concepts 


Among the high-level business cases, the higher priority 
concepts can be progressed to the next stage of developing 
POCs. This can involve building a limited functionality 
mock-up to determine whether the concept will work as 
envisioned. This should give a clearer view of the benefits, 
costs and implementation requirements of the solution and 
enable a more detailed business case. Once the concept 
has been validated and an implementation plan has been 
laid out, it is time for senior management to give the green 
light. 


Validation should also look at the challenges before 
developing solutions. This should include a realistic 
assessment of implementation challenges and how to 
overcome them. The survey highlights that data being 
in the wrong format or policy restrictions are major 
challenges. Unless these problems are well understood 
with clear solutions, then significant time could be wasted 
in the development phase. 


Develop working solutions 


To develop workable solutions, banks could consider 
an Agile and well governed development approach. If 
developing a solution internally, this stage involves putting 
together a full implementation team, made up of a 
balance of business and technology professionals. This can 
benefit from an Agile methodology, comprising a series of 
incremental time-boxed sprints. Functional testing should 
be built into relevant sprints at the appropriate stages 
of development, while User-Acceptance-Testing should 
be carried out in the final sprints towards the end of the 
development process. If using a third-party vendor, the 
focus is around customising an existing solution to the 
organisation. It is equally important to ensure that the 
vendor has sufficient support from both business and IT 
to be able to ensure needs are met. It is also important to 
build a robust testing framework into this phase. 


Deploy to realise value 


Deployment is the most critical activity in realising the 
benefits of a solution. However, development tends to take 
up a significant portion of time and resources and can lead to 
deployment getting neglected. When technology projects 


go over time and budget, it is usually the deployment 
phase that gets contracted in order to make up for lost time 
or investment. It is critical to have an appropriate change 
management strategy in place and to ensure that end 
users have sufficient guidance and training to be able to 
realise the end benefits. Successful deployment requires 
planning, early and frequent communication, training and 
capability building, change management and adequate 
deployment support. 


4.2 Use of external providers 


Developing Regtech solutions in-house vs 
using third-party providers 


Regtech solutions can be developed in-house or provided 
by an external vendor. 61% of the surveyed banks that 
have adopted Regtech solutions use third-party providers 
(Figure 14). A number of factors need to be considered to 
help decide which approach can bring the greatest benefit. 


Developing Regtech solutions in-house allows a greater 
level of customisation and helps to train staff and expand 
their skillset in parallel. However, the time, resources and 
effort spent in developing a solution from scratch can be 
significant. 


Purchasing readily available third-party solutions can save 
time and resources, and provides banks with the comfort of 
a proven track record. Third-party vendors typically possess 
domain expertise, which banks can leverage to assist with 
implementation. However, these readily available solutions 
may not be fully compatible with existing infrastructure and 
policies, and can therefore be challenging to integrate. 


There is no one-size-fits-all approach. In order to ensure 
the successful implementation of Regtech, banks should 
carefully weigh the pros and cons of whether to develop a 
solution in-house or to purchase third-party solutions. 


Five key attributes of an effective partnership 


While partnering offers numerous benefits, including 
access to talent, enablement of a portfolio approach and 
increased speed to market, it is not a straightforward 
process. Organisations that have established partnerships 
have found themselves mired in roadblocks, from lacking 
the APIs required to enable seamless integration to 
the time-consuming process of establishing governance 
structures and risk management processes. Without 
strong guiding principles and a strategy for managing 
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Figure 14: Responsible parties for the development of Regtech solutions at surveyed banks 


Combination of third-party Regtech solution 
providers and in-house developers/ related- 
party Regtech development teams 


Third-party Regtech solution providers 


In-house developers/ related-party Regtech 
development teams 


We don’t currently use Regtech solutions 


Source: HKMA Regtech Survey for Authorized Institutions, KPMG analysis 


partnerships, it is highly unlikely that financial institutions 
will be able to achieve the full value that working with 
Regtech companies can provide. 


The ability to forge successful partnerships will be a key 
strength of a successful bank in the future. Developing 
Regtech partnerships requires a significant amount of 
time and effort from financial institutions — both to identify 
the right Regtech companies with whom to partner, and 
to ensure the resulting partnerships are structured so 
that both parties can achieve their desired objectives. A 
KPMG survey% identified five key themes for effective 
partnerships for fintech companies that can be applied to 
Regtech. These include: 


1 Focus: Leading companies know what goals they want 
to achieve or issues they want to address through 
Regtech and potential partnerships with Regtech 
companies. When looking for opportunities, leading 
financial institutions start with the problem rather 
than the technology to ensure there is demand for a 
solution and that any solution provides the required 
value. Before attempting to ‘plug and play’ a Regtech 
solution or partner into their organisation's operations, 
they work to ensure activities are well aligned in order 
to reduce integration challenges. 


2 Evaluation framework for Regtech: Creating and 
using strong evaluation frameworks are an important 
part of ensuring that any Regtech partnerships 
are well positioned to achieve specific outcomes. 
Leading companies use frameworks aligned to their 
business strategy, specific pain points and desired 








61% adopted 
Regtech solutions 
using third-party 
providers 


outcomes, in addition to the specific characteristics 
of the Regtech being evaluated (e.g. the quality of the 
Regtech company’s management team, the alignment 
of its strategic objectives with your own, its technology 
capacity, the scalability of technology solutions, potential 
integration challenges and cultural differences). 


Outside the box thinking: In today’s constantly evolving 
Regtech environment, effective partnerships can be 
established with a variety of different organisations, 
from Regtech start-ups and technology giants to 
companies in ancillary industries, to actual business 
competitors. Leading companies look beyond traditional 
boundaries to form partnerships, forging alliances with 
companies well beyond their own sector in order to 
leverage insights, solutions and opportunities. 


A global mindset: Regtech innovation is evolving 
in unique ways in many different geographies as a 
result of their unique skills bases, innovation centres, 
government priorities and collaborations. Leading 
companies often have a presence in key Regtech 
ecosystems in order to stay on top of signals of change 
and to help identify potential partners from outside their 
local jurisdictions. 


Experienced advisors: When it comes to identifying 
and establishing partnerships, many leading companies 
have a network of advisors who can supplement their 
existing skill sets and provide assistance with evaluating 
partnership opportunities and with managing the legal 
and risk management issues that might arise during 
the development and execution of any partnership 
arrangements. 


3% Forging the future: How financial institutions are embracing fintech to evolve and grow, KPMG International (October 2017), https://assets.kpmg/content/dam/kpmg/xx/pdf/2017/10/forging-the- 


future-global-fintech-study.pdf 
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Kecommendations 


oO 
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5.1 Vision and introduction to 
the recommendations 


Section 2 outlined how widespread adoption of Regtech 
in Hong Kong presents significant benefits to the banking 
ecosystem in Hong Kong and to the overall economy. There 
are considerable opportunities to help those institutions 
that are yet to implement Regtech and guide those that 





Ne adoption O 


have adopted solutions to improve implementation and 
expand use cases into emerging areas. Hong Kong has the 
right ingredients to support a thriving Regtech ecosystem: 
broader fintech capabilities, strong support for technology 
businesses, a large financial sector and a supportive 
regulator. 
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To help stimulate and focus development, Hong Kong 
should aim for a number of goals: 


e Hong Kong as a global leader in Regtech 


e Extensive adoption of Regtech in the Hong Kong 
banking sector 


e Breeding ground of Regtech solutions for financial 
institutions 


e Hong Kong as a hub for nurturing Regtech talent. 


Figure 15: Summary of recommendations 
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This white paper sets out 16 recommendations across 
five core areas which, if realised, would help to accelerate 
Regtech adoption in Hong Kong and meet these outcomes 
(Figure 15). The recommendations highlighted below have 
been formulated based on the survey findings, interviews 
with industry stakeholders, benchmarking and analysis 
of Hong Kong's progress thus far and a comparison with 
observations and developments in other jurisdictions. 


Encourage exchange of knowledge about Regtech by 
creating a Regtech knowledge hub 


Improve sharing of experience in implementing Regtech 
through issuing Regtech adoption practice guides 


Boost widespread awareness about Regtech across the 
industry by hosting targeted events 


Build acceptance of key technologies that enable Regtech 
adoption via targeted events and publications 


Accelerate Regtech adoption by exploring the benefits of 
providing financial incentives and other assistance 


Attract global Regtech firms to develop and showcase 
solutions for common problem statements by hosting a 
Regtech Challenge 


Address common pain points by encouraging the formation 
of consortiums 


Stimulate new innovation by facilitating better access to 
existing infrastructure and developing new infrastructure 


Encourage cross-border Regtech collaboration via targeted 
outreach 


. Create an environment conducive to international Regtech 


implementation by continuing to engage regulators in 
other jurisdictions, including the Greater Bay Area 


. Reaffirm the HKMA’s focus on promoting Regtech 


development by continuing to communicate and share 
Regtech-related expectations and guidance to the broader 
Regtech community 


. Nurture a Regtech talent pool by developing a skills 


framework for Regtech adoption 


. Formalise Regtech training by exploring the idea of 


introducing or enhancing Regtech modules for relevant 
industry courses 


. Expand the Regtech ecosystem by continuing to work with 


financial institutions and other regulators in Hong Kong 


. Provide a clear way to measure and guide success in 


Regtech adoption by developing and publishing a Regtech 
Adoption Index 


. Magnify impact of the initiatives by enhancing the 


collaboration with Regtech-related industry associations 
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5.2 Boost awareness 


Clear advantages to raising awareness of 
Regtech and its associated benefits; events 
play a key role in this 


The research for this white paper points to a clear need to 
increase awareness of the potential benefits of Regtech 
and Regtech solutions available to the banking industry 
in Hong Kong. 40% of banks cited a lack of awareness 
of Regtech solutions or their potential value as a top 
five adoption barrier, while surveyed Regtech providers 
highlighted this as their second highest barrier to adoption. 


Many banks do not know where to find 
comprehensive information about Regtech 
adoption 


A number of bank interviewees have suggested that they 
do not know where to find relevant detailed information 
about Regtech, which may end up slowing the rate of 
overall Regtech adoption in Hong Kong's banking industry. 


The HKMA‘s Fintech Supervisory Chatroom is one initiative 
that both interviewed banks and Regtech providers cited 
as helping to raise awareness and centralise discussion 


and interaction between stakeholders. As at 31 July 2020, 
about 22% of all enquiries in the Chatroom were related 
to Regtech. 


While the Chatroom has proven to be a helpful medium to 
centralise discussion around Regtech, there is also a need 
for information, use cases and guidance to be centralised 
to help increase awareness, encourage knowledge sharing 
and ultimately drive greater adoption. 


Other centralised platforms have proven 
successful 


Similar centralised platforms set up by Hong Kong 
government agencies have proven successful for other 
initiatives, such as InvestHK’s Fintech HK website. This 
standalone website targets a wide range of users and 
includes detailed information on areas such as guidelines 
on setting up a fintech business, relevant fintech use 
cases, and related news and events. 


In the UK, the FCA has a Regtech knowledge hub 
that allows easy access to a variety of Regtech-related 
publications, news and circulars, as well as a dedicated 
advice unit for eligible companies. It also includes useful 
information on FCA initiatives such as the digital sandbox 
pilot and TechSprints®. 


Recommendation 1 





Encourage exchange of knowledge about Regtech by creating a Regtech 


knowledge hub 


Develop a Regtech knowledge hub that acts as a central repository of all Regtech-related content and knowledge 
sharing for the Hong Kong banking industry. It could also potentially extend to other financial institutions and 


beyond. 


Knowledge hub content could include past issues of Regtech Watch, the Regtech adoption practice guides 
(which are outlined in Recommendation 2), links to guidance and circulars related to Regtech, curated articles and 
secondary resources, details of upcoming events, Regtech-related FAQs, and external links to relevant industry 


associations and other financial services regulators. 





More detailed guidance is a key ask from 
the industry 


The HKMA's “Regtech Watch” newsletter has been 
helpful in promoting the adoption of Regtech in the banking 
industry. Interviewed banks cited these newsletters as 
a valuable souce of information and guidance, especially 
the actual or potential Regtech use cases that have been 





rolled out or are being explored in Hong Kong or elsewhere. 
Four issues of Regtech Watch have been issued since its 
launch in November 2019. The inaugural issue covered 
cyber risk management, followed by an issue on credit risk 
management in March 2020, on AML/CFT in June 2020, 
and on conduct risk management in September 2020. 


3 Regtech, Financial Conduct Authority (September 2020), https://www.fca.org.uk/firms/innovation/regtech 
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While acknowledging regulatory efforts so far to provide 
guidance on the adoption of Regtech, a number of 
interviewees hope to receive further elaboration on the 
potential application and benefits of Regtech. In line with 
the interviews, 32% of surveyed banks ranked the issuance 
of ‘Regtech adoption practice guides’ as the most effective 
potential initiative for promoting Regtech adoption in the 
banking industry in Hong Kong. This was ranked as the 
top initiative consistently among a broad cross-section of 
banks, including locally and overseas incorporated banks, 
and among banks with different asset sizes. Surveyed 
respondents that had implemented solutions — which 
includes the virtual banks — also cited Regtech adoption 


practice guides as the top potential initiative, indicating that 
even the industry players that are generally further along in 
their Regtech adoption journey would benefit from more 
guidance. 


With this white paper identifying 26 specific application 
areas of Regtech that can benefit financial institutions, there 
are significant opportunities and a desire from the industry 
for the HKMA to develop and issue Regtech adoption 
practice guides. This should include more guidance on 
implementation and advice on overcoming barriers. 


Recommendation 2 





Improve sharing of experience in implementing Regtech through issuing 


Regtech adoption practice guides 


Develop a “Regtech Practice Guides” series that could potentially build on or supersede the “Regtech Watch” 


newsletter series. 


These practice guides should continue to incorporate useful elements of Regtech Watch (e.g. highlighting 
existing industry challenges, raising awareness of how Regtech can help address these challenges, identifying 


potential Regtech use cases). 


The practice guides should explore areas beyond the current scope of Regtech Watch: 


e Elaborate on existing industry challenges and potential benefits of Regtech solutions based on the 
survey and interview findings, as well as ongoing engagement with industry through both regular supervisory 


activities and Regtech-specific engagement activities. 


e Provide more implementation guidance on specific regulatory areas that the industry commonly finds 
challenging to interpret or is unsure of regulators’ expectations. The guidance should be granular enough for 
banks and Regtech firms to identify an adoption process that is in-principle applicable to their circumstance, 
with a reasonable degree of confidence that regulators’ expectations have been met. 


e Draw upon learnings from prior use cases from banks, enquiries from the Fintech Supervisory Chatroom, 
learnings from the FSS, as well as other relevant engagement with the industry, including Regtech firms. This 
should include advice on overcoming barriers to adoption. 


Each practice guide should focus on an area of Regtech application and seek to prioritise areas that have been 
identified as having the greatest potential impact on increasing adoption rates across the industry and/ or 


promoting awareness. 


Opportunity to expand the range of events in 
order to reach different stakeholder groups 


There are already a number of events in Hong Kong that are 
well regarded by the industry. This includes large events 
such as Fintech Week. While the large events can attract a 
sizeable audience, they tend to be focused on participants 
that already have an interest in this space. 


Effective Regtech adoption requires a range of stakeholders 
from across the organisation to buy in and collaborate in 
order to drive success. However, interviewees cited that 
Board members and senior and middle management are 
not well targeted by existing events. 
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These individuals play a key role in originating, implementing 
and signing off on Regtech-related initiatives. Their 
awareness of the benefits of Regtech and support for 
related initiatives is therefore essential. 


Insights from interviews highlighted that there is also a 
need to increase awareness among banks’ regional and 
global senior management. This is particularly important in 
Hong Kong, where a number of foreign bank branches have 
Regtech solutions driven from a global level. The recent 
widespread adoption of video conferencing for events in 
response to COVID-19 may unlock new opportunities to 
encourage management in different jurisdictions to more 
actively participate in virtual events hosted in Hong Kong, 
therefore increasing their awareness of Regtech solutions 
and benefits. 


Regulator involvement in events Is viewed 
by the industry as a clear demonstration of 
commitment 


Banks and Regtech providers stressed the importance 
of the HKMA’s presence and participation in events to 
help support the promotion of Regtech in Hong Kong. 
Hosting Regtech events was cited by surveyed banks 
and interviewed overseas regulators as one of the most 
effective initiatives to promote adoption in Hong Kong. 
The HKMA's AML/CFT RegTech Forum held in November 
2019 generated positive feedback from the industry, and 
has helped to increase awareness about AML/CFT as a key 
application area for Regtech. 


Recommendation 3 





Boost widespread awareness about Regtech across the industry by 
hosting targeted events 


Hosting targeted events will help to galvanise the global community and act as a clear indicator of commitment 
in this area. These events should take some of the following points into account: 


Regulator to play a prominent role: Regulators’ active participation in events significantly raises the profile 
of the event and attracts higher attendance rates. 


Content: The focus should be on the benefits of Regtech solutions, successful implementation and details on 
how to implement solutions. This can also involve training and new approaches to upskill talent. 


Follow a combination of formats: Host both large-scale events and smaller niche events to focus on 
different objectives and groups of participants. Consider the use of different formats such as keynote 
speeches, panel discussions, curated live demonstrations, break-out sessions and workshops. While the 
COVID-19 pandemic has had an impact on physical events, it has also shown that fully virtual or a combination 
of online and in-person events can be equally, if not more, impactful and effective. A virtual event also provides 
the opportunity to expand the scope of the potential audience to include stakeholders from regional and global 
banks’ headquarters or other offices, and Regtech solution providers from different jurisdictions. 


Target different groups: Awareness needs to be raised across different groups ranging from Board level and 
senior management to middle management and project working level staff of banks. Targeted groups also 
vary by functional background, ranging from risk and compliance to IT and other business functions. 


Involve Regtech firms and professional service providers: These events also serve as networking 
opportunities to connect banks with Regtech firms and other professional service providers. 


Use industry associations as a multiplier: Industry associations can play a key role in organising or 
co-organising events, developing content and promoting events to their members. 


Consider how to engage stakeholders in head office: Awareness and support needs to be built at all levels 
of decision making. This means that certain events should aim to attract senior management from regional 
and global head offices. 
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Several technologies underpin the adoption 
of Regtech 


Regtech is underpinned and enabled by a number of 
prominent established and emerging technologies across 
a range of compliance and risk management use cases. 
As shown in Section 2.3, a wide range of technologies 
can be harnessed to develop Regtech solutions, ranging 
from more established technologies such as cloud to more 
emerging areas of NLP and OCR. In particular, cloud is 
considered a fundamental underpinning technology for 
Regtech that banks need to be comfortable with before 
they seriously consider specific Regtech solutions. Al and 
Al technology is used to underpin more advanced Regtech 
solutions. 


The HKMA‘s stance on key underpinning 
technologies has been defined, but more 
promotion and guidance could further help 
to drive adoption 


There is an opportunity for the HKMA to drive Regtech 
adoption by further promoting its stance on key 
underpinning technologies for Regtech, such as cloud 
and Al. 23% of surveyed banks perceive the regulators in 
Hong Kong as having a negative sentiment towards cloud- 
based Regtech solutions (Figure 16). With many Regtech 
providers leveraging cloud as a foundational technology for 
their solutions, this perception is a significant challenge to 
Regtech adoption. 
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The HKMA has set out its position on the adoption of 
cloud-based technology solutions in the Risk Assessment 
Form on Technology-related Outsourcing (including Cloud 
Computing) Project, which guides banks through the 
assessment process. There are an increasing number of 
industry use cases where banks have undertaken this 
assessment process and successfully deployed cloud- 
based solutions. Promotion of these success cases would 
be beneficial to other banks that have not yet adopted 
cloud-based technology solutions. 


In recognition of the increasing number of banks adopting 
Al-based technology solutions across an expanding 
range of applications, the HKMA issued two circulars 
in November 2019 - High-level Principles on Artificial 
Intelligence’ and Consumer Protection in respect of 
Use of Big Data Analytics and Artificial Intelligence by 
Authorized Institutions’. The circulars seek to provide 
high-level guidance to the banking industry on the use of 
Al applications and key considerations when building big 
data analytics and Al platforms. Building on these circulars 
with promotional events and supplementary publications 
would be helpful in raising awareness about the HKMA‘s 
expectations on the application of these key technologies. 


Recommendation 4 





Build acceptance of key technologies that enable Regtech adoption via 


targeted events and publications 


Consider issuing a set of high-level principles on the use of cloud technology to clarify expectations and facilitate 


the adoption of cloud-based Regtech solutions. 


This can be followed up with targeted events or publications to help the industry to better understand the 
HKMA‘s expectations on the application of key technologies that power Regtech solutions. This is also an avenue 
to share what is possible and use cases that have been successful. 


These events and publications could take the form of seminars and guidance papers. 





5.3 Promoting solution 
innovation 


Clear need to enhance maturity of solutions 
and greater localisation of solutions 


As outlined in Section 3.2 (Regtech adoption challenges), a 
lack of solutions tailored for the local regulatory/ linguistic 
environment in Hong Kong features prominently as a key 
barrier to adoption. Bank interviewees cited a number of 
instances where some Regtech solutions developed in 
other markets did not adequately address local regulatory 
requirements, or were not suitable for the bank's specific 
business or operational circumstances and setup. 





Interviewed banks and Regtech providers also pointed out 
that Hong Kong is a relatively small market, at least for 
retail banking, and one where developing tailored solutions 
is not always cost effective. There is therefore a need 
to foster solution innovation in order to make Regtech 
development and adoption more cost effective for both 
banks and Regtech providers, and to ensure that there is 
greater tailoring of solutions that address local issues. This 
suggests the need for intervention to create a virtuous 
cycle where more localisation of solutions can drive greater 
adoption and lower costs, which in turn could lead to more 
localisation. 


38 High-level Principles on Artificial Intelligence, Hong Kong Monetary Authority (November 2019), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 


circular/2019/20191101e1.pdf 


37 Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions, Hong Kong Monetary Authority (November 2019), https://www.hkma.gov.hk/ 


media/eng/doc/key-information/guidelines-and-circular/2019/20191105e1.pdf 
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Cost management is a key focus for banks 


The current challenging external environment has placed 
cost management front and centre for banks. ‘Budget and 
resource constraints’ was cited by surveyed banks as the 
top barrier to Regtech adoption. While Regtech solutions 
can help banks to reduce costs, the upfront investment is 
often difficult to fund for many banks that are managing 
tight budgets. To address this, there is an opportunity to 
provide financial incentives to foster the innovation and 
development of solutions. 


Similar jurisdictions offer financial incentives 
to help stimulate solution development 


In Singapore, MAS and the SFA have a variety of funding 
schemes to accelerate technology adoption in the 
financial services sector. There are nine grants that target 
fintech solution development, adoption or establishment 
of a technology innovation hub in Singapore. Financial 
institutions and fintech firms in Singapore have tapped into 
these grants to implement Regtech projects. 


Both interviewed banks and Regtech providers pointed 
to financial incentives and assistance such as these as 
positive initiatives that would help attract more Regtech 
providers to expand local operations, spur greater solution 
innovation, and cater to a wide range of bank needs. 


Hong Kong has a number of examples of 
financial incentives being used to boost 
innovation 


There are several examples of financial incentives being 
used in Hong Kong to successfully stimulate technology 
innovation. The Innovation and Technology Commission 
has initiatives such as the Enhanced Tax Deduction for 
R&D - Designated Local Research Institutions (DLRI) to 
encourage more enterprises to conduct R&D activities 
in Hong Kong, and a Technology Voucher Programme 
(TVP), which aims to support local organisations in using 
technological services and solutions to improve productivity, 
or upgrade or transform their business processes. 


Recommendation 5 





Accelerate Regtech adoption by exploring the benefits of providing 
financial incentives and other assistance 


The provision of financial incentives could stimulate Regtech solution development and increase adoption, 
especially among the 75% of surveyed banks and 55% of Regtech providers that cited budgetary constraints as 


a key barrier to adoption. 


The HKMA could explore the establishment of a scheme to provide financial incentives for banks and Regtech 
providers to develop and adopt Regtech solutions. Several aspects can be considered, such as partial funding up 
to a cap, targeted funding by bank/ Regtech size or development stage, and ensuring that as much of the financial 
incentives as possible are used for Hong Kong-based activity. Other factors for consideration include ensuring 
that regulatory observers are present at key milestones to monitor progress and learn, and making sure learnings 


are fed back to the wider ecosystem. 


Alternatively, the HKMA could also explore the provision of other assistance to banks and Regtech companies to 
encourage Regtech solution innovation and development in Hong Kong — for example, partnering with business 
parks and hubs to provide office space to Regtech providers, and providing Regtech companies with greater 
access to test data and environments, thereby lowering entry barriers. 
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‘Hackathon’ or ‘Hackcelerator’-style events 
can be used to rapidly develop use cases 


A hackathon is an event where teams of solution providers 
come together for a short period of time to develop 
solutions that solve a particular pain point. They usually 
involve some kind of incentive, are effective at solving 
issues extremely rapidly, and can be useful for developing 
Regtech solutions. They have secondary benefits of 
acting as an awareness tool to demonstrate the ability 
of technology to solve a problem, as well as attracting 
investment and/ or partnership opportunities with venture 
capital and private equity firms. A Hackcelerator is a similar 
concept, except the time period is extended, usually 
lasting for a couple of months. This allows for a greater 
focus on the coaching and mentorship aspects, creating 
more partnership opportunities for participating teams with 
potential clients and investors. 


Both the UK FCA and MAS have used Hackathons and 
Hackcelerators to great effect for Regtech-style issues. For 
example, the FCA’s TechSprints are typically 2-day events 
of varying scale and size that bring together a wide range 
of ecosystem stakeholders to showcase fintech — including 
Regtech — solutions or POCs to address specific industry 
pain points. The MAS Global FinTech Hackcelerator is a 
12-week programme co-hosted by KPMG since 2016. It 
seeks to create and match solutions with industry needs. 
Each year, 20 finalists are selected across three focus 
areas and a general category. These finalists work with 
key stakeholders from the financial services industry 
(for example, Chief Risk Officers, Heads of Fintech and 
Innovation) to contextualise their solutions to client and 
industry needs. Three winners receive a total cash prize 
of SGD 150,000, and all 20 finalists receive fast-tracked 
applications for MAS's Financial Sector Technology and 
Innovation (FSTI) Proof-of-Concept grant. To date, a large 
portion of the winners have progressed their solutions to 
the POC stage with banks. 
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Recommendation 6 





Attract global Regtech firms to develop and showcase solutions for 
common problem statements by hosting a Regtech Challenge 


A Regtech Challenge that resembles a hackcelerator-style event would help to attract start-ups, corporates 
and investors from across the industry globally to develop technology-based ideas or POCs to address industry 
challenges that are specific to Hong Kong. There are a number of common practice areas that can be adopted 
around the definition of clear, real-life problem statements, ensuring the opportunities are made for lasting 
partnerships (e.g. potential clients and investors as judges and/ or mentors) and ensuring that participants have 


adequate supporting data sets and technology. 





Consortiums are effective vehicles to pool 
resources to develop solutions 


A consortium, where several financial institutions work on 
a solution, can help to pool resources to develop solutions 
that benefit all. This is particularly useful where the 
investment required or risk involved to develop a solution 
is not commensurate with the benefit for a single provider. 
A consortium can help to agree on a set of common 
standards that facilitate Regtech as well as investment in 
technology. A number of interviewed banks agree that the 
formation of consortiums could help to accelerate Regtech 
solution development in the banking industry in Hong 
Kong. Furthermore, a number of banks indicated their 
willingness to participate in such a consortium. 


There are examples of successful use of consortiums in 
this space. For example, the FCA and the Bank of England 
(BoE) jointly introduced Digital Regulatory Reporting to 
make regulatory reporting more efficient and effective’®. 


Between 2018 and 2019, the BoE and FCA collaborated 
with seven banks to complete two pilots on Digital 
Regulatory Reporting, which are showing positive progress. 


A number of interviewees noted that there is a key role for 
the regulator to identify common pain points, set specific 
problem statements, work with intermediaries such as 
industry associations to form consortiums, set clear 
standards and offer guidance to the consortium. There are 
several principles that have worked well in other markets 
that should be adopted when considering a consortium. 
For example, it should not be in an area where participants 
could expect to gain a competitive advantage. It should 
be an area of high cost or burden to financial institutions. 
It should also not be an area exposed to high reputational 
risk, and most importantly, the use case has to be very 
compelling for a large number of financial institutions. 
Commentators in other markets also stress the importance 
of getting a few big banks involved first. 


Recommendation 7 





Address common pain points by encouraging the formation of 


consortiums 


Industry, regulators and industry bodies should work together to identify and form consortiums to address 
specific Regtech challenges. A number of initial problem statements for further consideration include regulatory 
reporting, stress testing for regulatory purposes and model validation. 








38 Digital regulatory reporting, Financial Conduct Authority (July 2020), https:/Awww.fca.org.uk/innovation/regtech/digital-regulatory-reporting 
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Solution innovation requires the right 


infrastructure 


Interviewees stressed the importance of having the right 
infrastructure to enable Regtech providers to build their 
solutions. This involves centrally maintained databases 
and infrastructure to help adoption. There are a number 
of examples that often required collaboration across 
regulators and government to implement. Such solutions 
are sometimes grouped as part of a ‘Smart City’ initiative. 


Singapore's ‘SingPass’ is a commonly cited example of 
this. SingPass is an authentication system for citizens to 
transact with government agencies online, allowing users 
to access government digital services easily and securely 
(e.g. tax payment, payment for driving licence). For banks, 
it helps with on-boarding and biometric identification 
(fingerprint or facial recognition) to log in to digital services. 


Another example is MRR, which refers to the use of 
technology by regulators and financial institutions to 
automate the dissemination and processing of regulatory 
requirements. An internal HKMA study on MRR found 
that the relevant technical standards (e.g. use of Al 
and machine learning techniques to interpret regulations) 


are still at an experimental stage, while the coding of 
regulations into computer programmes has only been 
tested on a very limited scale. The study also showed 
that the general preference of banks is to explore the use 
of MRR to facilitate (as opposed to replace) the human 
process of compliance. 


In the area of regulatory data reporting, the study found 
that instructions need to be codified while data needs 
to be structured and compiled in standardised forms for 
machine recognition and execution. This is currently at an 
early stage of development. There is therefore a need to 
invest in infrastructure that can facilitate standardised and 
enhanced regulatory reporting. 


Apart from infrastructure, having access to appropriate 
data sets can help Regtech firms and banks with the 
solution development and testing process. ASIC has 
previously provided curated data sets to Regtech firms 
to showcase their solutions at a series of symposiums. 
The FCA has launched a digital sandbox with a focus on 
providing synthetic data sets to a range of stakeholders, 
including incumbents, Regtech firms, technology providers, 
academics and regulators, to test technology solutions. 


Recommendation 8 





Stimulate new innovation by facilitating better access to existing 
infrastructure and developing new infrastructure 


Consider providing better access to existing infrastructure, investing in new infrastructure and the provision of 
data sets that enable the development of new Regtech solutions. This could be a focus of a Regtech Challenge 
or other avenues to help develop such infrastructure. Initial technologies for consideration may include electronic 
dissemination of regulatory policies and upgrades to the regulatory reporting platform. 


Explore and investigate options to enhance policy assimilation and dissemination processes through 
the use of emerging technology where available (short to medium term). Increased automation in such 
processes would, for instance, assist banks in better monitoring regulatory developments and changes. In 
addition, the use of tools such as topic and keyword tagging in regulatory documents would complement the 
searching capability of banks’ IT systems and contribute to the effectiveness and efficiency of their regulatory 
compliance processes. 


Consider developing a digital reporting regime (longer term) that incorporates MRR reporting instructions, 
which is only possible when there is a proven technical standard agreed by the industry. Continue to keep in 
view the development of emerging IT applications of relevant technologies as the HKMA GDR (Granular Data 
Repository) initiative proceeds. 


Consider hosting a Regtech Challenge featuring a regulatory reporting problem statement to encourage 
banks to focus on this issue and the potential benefits of MRR in this context. Explore the formation of a 
consortium to pool efforts and expedite the development of an industry consensus on technical standards. 


Continue to monitor the government’s Smart City initiatives and engage with Regtech providers and 
banks to identify other potential infrastructure to explore. 
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Important to attract global Regtech providers 
to Hong Kong 


In order to harness leading Regtech solutions, Hong Kong 
needs to attract more global Regtech companies. This 
would not only give local banks access to a wider range 
of solutions, but would help deepen the local ecosystem 
in order to develop critical mass in areas such as talent. 
It would also help Regtech providers, as Hong Kong has 
the potential to become a regional hub that can serve a 
number of markets in Southeast Asia and East Asia, and 


have clear benefits for the Hong Kong economy in terms 
of employment, tax revenue and upskilling the workforce. 


In addition, the GBA is rapidly transforming into a world- 
class technology hub with globally renowned tech unicorns 
and advanced capabilities in a range of fields such as Al and 
big data. The technology capabilities in GBA cities can be 
combined with Hong Kong's expertise as an international 
financial hub to develop internationally recognised Regtech 
solutions. 


Recommendation 9 





Encourage cross-border Regtech collaboration via targeted outreach 


Targeted events and guidance to encourage cross-border solution development, bringing technology innovation 
from other markets and developing Regtech solutions within Hong Kong. Events can include presentations, 
targeted visits and panel discussions, with an emphasis on bringing together financial institutions and Regtech 
firms across borders to encourage greater sharing of ideas and partnerships. Involvement of regulators from 


related jurisdictions would be a clear indication of priority. 
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5.4 Regulator engagement 
with ecosystem 


Cross-border alignment of regulatory 
stance and supervision of Regtech will help 
promote Hong Kong as a leading financial 
services hub 


A large portion of banks in Hong Kong are headquartered 
in other jurisdictions. Differences in approach to Regtech 
across jurisdictions create significant challenges for banks 
that must align with their group’s overall technology 
strategy. While complete alignment may not always be 
possible, continued communication and information sharing 
between regulators and regular participation in cross-border 
events are nevertheless beneficial for highlighting issues 
and keeping up with international common practices. 
Particular focus should be given to alignment with the 
other major financial services hubs in the region. This will 
help align regional and global banks with regard to their 
technology solutions, which is beneficial for the Asia- 
Pacific region as a whole. 


Regional and international engagement 
could positively impact Regtech adoption 


International collaboration is another key driver of a 
wider Regtech ecosystem. The HKMA has been actively 
participating in international networks such as the working 
groups under the BIS and the FSB, as well as GFIN to 
strengthen Regtech collaboration and experience sharing. 
Furthermore, collaboration between the respective 
governments and regulators in Mainland China, Hong 
Kong and Macau in recent years has yielded a range of 
welcome technology-related developments such as the 
expansion of Cyberport, the development and location of 
research institutions in Hong Kong Science and Technology 
Parks, and R&D tax incentives. Hong Kong's status as an 
international financial centre and goal of strengthening 
innovation and technology leave it well placed to support 
fintech/ Regtech firms. Industry commentators hope 
that the positive collaboration and alignment among the 
regulators can continue. 


Recommendation 10 





Create an environment conducive to international Regtech implementation 
by continuing to engage regulators in other jurisdictions, including the 


Greater Bay Area 


Continue to engage and participate in cross-border regulatory groups such as the working groups under the 
BIS and the FSB, as well as GFIN to align Hong Kong's Regtech regime with international common practice, and 


to facilitate Regtech collaboration and experience sharing. 





The regular issuance of detailed Regtech- 
related guidelines, FAQs and circulars 
reaffirms the HKMA’‘s focus on promoting 
Regtech innovation and adoption 


HKMA circulars and guidelines related to Regtech and its 
underpinning technologies have been well received by a 
number of interviewees. Interviewees also have a positive 
view of the transparency and overall communication 
efforts displayed by the HKMA. Keeping this momentum 
going through the regular issuance of detailed guidelines 
and circulars will help to advocate the HKMA's role as a 
facilitator of Regtech innovation, and promote Regtech 
adoption in Hong Kong. 


There is a balance to be struck between following a 
principle-based approach and detailed guidance. Most 
financial institutions agree that a principle-based approach 
is preferable, but there are certain more commoditised 
areas where clear, detailed guidance is helpful. One cited 
example was in setting a margin of error in the number 
of ID cards that were electronically verified, which in the 
absence of guidance, many in the industry may have 
assumed to be 0%. This resulted in the delay of the rollout 
of the technology. 


Involvement of Regtech firms is crucial to the overall level 
and quality of solution innovation in Hong Kong. 
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To ensure that solutions address the needs of banks and 
are appropriate and compliant with banking regulations, the 
HKMA should continue to engage, communicate regulatory 


expectations and provide guidance to the broader Regtech 
community. 


Recommendation 11 





Reaffirm the HKMA’s focus on promoting Regtech development by 
continuing to communicate and share Regtech-related expectations and 
guidance to the broader Regtech community 


Continue to issue circulars, FAQs and more detailed guidelines with clear messaging on Regtech-related 
developments and issues to maintain transparent and regular communication with the industry. These should 
be disseminated beyond banks to the broader Regtech community, including Regtech firms, and should address 
areas where the industry commonly asks for regulators’ expectations on specific issues. This helps to avoid 
potential misinterpretations of the regulatory stance on technology solutions. The content of guidelines should 
be at a level of detail that adequately addresses common issues encountered by banks during the process of 


adopting Regtech solutions. 





5.5 Develop talent pool 


A need to address Regtech-related skill and 
experience gaps in Hong Kong 


44% of surveyed banks cited the lack of suitably skilled/ 
experienced talent as a top five barrier to Regtech adoption. 
The gap lies in finding talent that possesses the right 
combination of working knowledge of local regulatory 
requirements, technical skills within the technology and 
data analytics domain, and business acumen. This includes 
a number of technical roles at financial institutions across 
Risk, Compliance, Internal Audit, Operations, and to some 
extent IT. Resolving this issue requires a combination of 
upskilling existing talent as well as new hires. 


There is anecdotal evidence from multiple interviews 
that non-technology staff of all levels have found it 
helpful to attend internal training sessions that shed 
light on the latest fintech/ Regtech solutions and their 
underlying technologies. These employees are often 
users of technology solutions (e.g. customer risk profiling 
tools for customer-facing staff, GRC tools for risk and 
compliance teams, regulatory reporting solutions for the 
finance function), and training sessions enable them to 


better engage with the Regtech solution selection and 
implementation process. On the other hand, an observed 
lack of working level knowledge of regulatory requirements 
among technology professionals in the industry could also 
be addressed with relevant focused training. 


Interviewees also highlighted the opportunity to better 
equip regulator supervisory teams with greater knowledge 
of Regtech solutions. This upskilling helps supervisory 
teams to better understand the issues and challenges and 
provide more detailed guidance when discussing Regtech 
solution implementation with banks. 


Potential to embed Regtech skills in the 
HKMA’‘s ECF framework 


The HKMA's Enhanced Competency Framework (ECF) 
for Banking Practitioners provides a set of competency 
standards that enables more effective training for new 
entrants and professional development for existing 
practitioners. Interviewees pointed out a significant 
opportunity to build a Regtech module into this framework 
in order to create industry-wide alignment and foster talent 
development in this space. 
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Recommendation 12 





Nurture a Regtech talent pool by developing a skills framework for 


Regtech adoption 


Develop a Regtech skills framework that identifies the skills required for different roles to accelerate the adoption 
of Regtech. This can then be incorporated across the professional areas of the HKMA’s ECF. It can also be 
disseminated to banks themselves for them to develop training internally or share with external service providers. 





There are a range of industry and university 
courses that can help to promote Regtech 
skills 


Risk and compliance staff often hold a number of industry 
qualifications that may require ongoing professional 
training. The most notable example is the Financial Risk 
Management certification, which is targeted at risk 


management professionals. 325,000 have taken the exam 
globally over the last 20 years, with 50,000 certified 
members currently, including more than 1,500 in Hong 
Kong. Enhanced coverage of Regtech in these qualifications 
would aid in developing Regtech skills**. There are also a 
number of other courses in Hong Kong related to fintech 
or targeting attractive groups for building fintech/ Regtech 
skills. 


Recommendation 13 





Formalise Regtech training by exploring the idea of introducing or 
enhancing Regtech modules for relevant industry courses 


Explore opportunities to work with third parties that provide relevant courses or target relevant professionals to 
further deepen the Regtech talent pool. Consider developing Regtech-related content in new or existing modules 


of relevant industry courses. 





5.6 Sustain adoption 


Promoting the use of Regtech requires a 
joined-up regulatory response 


Regtech solutions typically factor in a range of laws and 
regulations from across government and regulators. This 
can be seen from the range of Regtech solutions involving 
data protection legislation, tax, company law and financial 
regulation. For example, according to KPMG analysis, 
around 60% of the application areas identified in our survey 
can be adapted to SFC-regulated entities, and around half 





for the insurance industry. Solution providers can often 
span across these application areas. There is therefore a 
need for collaboration across government to work together 
to drive Regtech adoption in Hong Kong and achieve the 
outcomes outlined in Section 5.1. 


There has been significant progress as a result of ongoing 
collaboration between regulators in Hong Kong, but more 
can be done. The single point of entry introduced in FSS 
2.0 is widely recognised by banks as an improvement from 
FSS 1.0 as it encourages collaboration between different 
regulators and cross-sector pilot testing. 


39 Financial Risk Manager (FRM), Global Association of Risk Professional, https://www.garp.org/#!/frm 


Transforming Risk Management and Compliance: Harnessing the Power of Regtech | 57 


Recommendation 14 





Expand the Regtech ecosystem by continuing to work with financial 
institutions and other regulators in Hong Kong 


Involve other regulators and government bodies to ensure opinions from different industry participants are 


well captured. 


Hold regular meetings to align different stakeholders and expedite the development of Regtech initiatives. 


Establish a clear mandate and targets to adequately inform different stakeholders and ensure that strategies 


are leading to the same goal. 





It is important to have a clear goal to 
measure the success of initiatives. Many 
international organisations already use 
public indices to track progress towards 
stated objectives 


It is important to have a clear and measurable way to 
demonstrate and monitor progress so that initiatives can 
be enhanced and updated. This can be challenging given 
the difficulties in gathering data and discerning the clear 
benefits from Regtech adoption. A number of global 
organisations use indices to track and monitor progress. 


The United Nation's Sustainable Development Goal (SDG) 
Index includes 17 interconnected goals and tracks each 
country’s performance, and publishes an annual report 
detailing each country’s performance against the goals. A 
range of companies already use the SDGs as a framework 
to benchmark their performance and assess the impact 
they are having on society and the environment. The World 
Economic Forum's Global Competitiveness Index assesses 
the ability of countries to provide high levels of prosperity 
to their citizens, and is a key reference for companies 
looking to improve ease of doing business. 
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In addition, the Global Fintech Index by findexable and 
Crunchbase, is a real-time ranking of fintech ecosystems 
and fintech companies worldwide’. The index uses metrics 
such as the size of the fintech ecosystem and supporting 


structures, the impact and performance of fintech firms, 
as well as the environment they are in, to calculate the 
rankings. 


Recommendation 15 





Provide a clear way to measure and guide success in Regtech adoption 
by developing and publishing a Regtech Adoption Index 


Develop a Regtech Adoption Index (RAI) that covers actual adoption, intent to adopt, as well as key enablers 
for adoption. Covering these elements will provide a more holistic and balanced framework to evaluate Regtech 
adoption among banks in Hong Kong. The introduction of an RAI is likely to convey the regulator's clear 
commitment to Regtech and their desire to understand the factors that are helping to promote or inhibit adoption. 
An RAI should measure banks’ Regtech adoption propensity and preparedness across four pillars: 


e Investment: Financial and resource commitments that have been, or are planned to be allocated towards 


Regtech. 


e Adoption: Breadth and extent of Regtech application within the bank, their readiness to adopt and the 


suitability of available Regtech solutions. 


e Talent and culture: Availability and development of Regtech-related skills, openness to innovation and 


leadership support. 


e Impact: Actual or perceived value generated from implementing Regtech. 





Industry associations play a key role in the 
Regtech ecosystem 


The presence of industry associations is deemed as 
important as they act as independent parties, focusing on 
organising seminars, promoting networking events and 
working with different stakeholders. 





40 Global Fintech Index by findexable, https://findexable.com/ 


There is an increasing focus on Regtech in Hong Kong. 
The Regtech Committee within the FinTech Association 
of Hong Kong helps to stimulate more discussion on 
Regtech RegTech 
Association of Hong Kong was formed in the last 12 


among industry players. The 


months by Regtech entrepreneurs. 
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Interviewed banks note that when the HKMA has engaged 
with Regtech associations and the wider industry, the 
outcome has been positive. A key example is the AML/ 
CFT RegTech Forum, hosted by the HKMA with the 
support of a consultant and in collaboration with the 
FinTech Association of Hong Kong, which was attended 
by around 400 representatives of banks, tech companies 
and experts, government agencies, financial regulators and 
law enforcement agencies who came together and shared 
insights in grasping opportunities for the use of innovative 
technology to enhance the efficiency of both banks and the 
wider AML/CFT ecosystem. 


Industry associations and regulators both 
benefit from close engagement 


E 





Interviewed regulators see the importance o 
associations as they act as a single channel for regulators 
to collect information, and help to relay information such as 
regulatory updates to the community. 


engaging with 


The RegTech Association in Australia, founded in 2017, is 
an independent association made up of about 120 members 
of Fls, banks and advisors. It organises around two events 
per month (pre-COVID-19) with a key focus on networking 
events and their own RegTech Awards, as well as hosting 
virtual events such as #RegTechEdgeNoBorders and 
#RegTech4Business, which are targeted at educating the 
public and members, respectively. ASIC is a key contributor 
to the development of Regtech as the association attends 
regular meetings with the regulator, and is given spots at 
their forums and roundtables. 


In Singapore, SFA's Regtech sub-committee enjoys strong 
support from MAS. It holds frequent meetings with MAS 
— for example, when developing a consultation paper, 
opinions will be gathered from the association as it acts 
as a single channel to consolidate responses from tech 
providers and other stakeholders. 


Recommendation 16 





Magnify impact of the initiatives by enhancing the collaboration with 


Regtech-related industry associations 


Explore opportunities to facilitate and enhance collaboration on Regtech-related initiatives across relevant 
Regtech or fintech associations to focus and accelerate development and adoption. 


Consider discussing with the Regtech Committee of the FinTech Association of Hong Kong and the RegTech 
Association of Hong Kong about increasing their involvement, perhaps as an observer for some meetings to 
encourage more dialogue on the wider adoption of Regtech. 
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5.7 Kick-off 


The HKMA recognises the importance of advocating its 
role in promoting and facilitating Regtech adoption in 
the banking industry in Hong Kong. The impact of each 
recommendation has been evaluated, factoring in the 
resources and time required to implement. The views on 
and progress of these recommendations can be separated 
into three categories: 


Planned initiatives: Initiatives that the HKMA will 
commit to introduce in the next two years. 


Existing activities: Existing activities that go some 
way to meet the recommendations listed in this white 
paper. These will be further assessed as to whether 
these should be expanded in the context of these 
recommendations. 


In consideration: Initiatives that the HKMA will 
further consider the benefit and feasibility of the 
recommendation before committing to further 
implementation. 


Activities for each recommendation are summarised in 
Figure 17. Target kick-off dates are estimated based on 
current plans, but may be revisited as circumstances 
change. 
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Figure 17: Summary of recommendations and progress 


Existing Planned In 


TOCOU AS activities Initiatives consideration 


Recommendation 1: Encourage exchange of 
knowledge about Regtech by creating a Regtech 
knowledge hub 


Recommendation 2: Improve sharing of experience 
in implementing Regtech through issuing Regtech 
adoption practice guides 


Recommendation 3: Boost widespread awareness 
about Regtech across the industry by hosting targeted 
events 


Recommendation 4: Build acceptance of key 
technologies that enable Regtech adoption via targeted 
events and publications 


Recommendation 5: Accelerate Regtech adoption by 
exploring the benefits of providing financial incentives 
and other assistance 


Recommendation 6: Attract global Regtech firms to 
develop and showcase solutions for common problem 
statements by hosting a Regtech Challenge 


Recommendation 7: Address common pain points by 
encouraging the formation of consortiums 


Recommendation 8: Stimulate new innovation by 
facilitating better access to existing infrastructure and 
developing new infrastructure 


Recommendation 9: Encourage cross-border Regtech 
collaboration via targeted outreach 


Recommendation 10: Create an environment 
conducive to international Regtech implementation by 
continuing to engage regulators in other jurisdictions, 
including the Greater Bay Area 


Recommendation 11: Reaffirm the HKMA’s focus 
on promoting Regtech development by continuing to 
communicate and share Regtech-related expectations 
and guidance to the broader Regtech community 


Recommendation 12: Nurture a Regtech talent pool 
by developing a skills framework for Regtech adoption 


Recommendation 13: Formalise Regtech training by 
exploring the idea of introducing or enhancing Regtech 
modules for relevant industry courses 


Recommendation 14: Expand the Regtech ecosystem 
by continuing to work with financial institutions and 
other regulators in Hong Kong 


Recommendation 15: Provide a clear way to measure 
and guide success in Regtech adoption by developing 
and publishing a Regtech Adoption Index (RAI) 


Recommendation 16: Magnify impact of the initiatives 
by enhancing the collaboration with Regtech-related 
industry associations 
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The following table (Figure 18) summarises additional 
details about existing activities conducted by the HKMA 
that align to the recommendations listed in Figure 18. 


Figure 18: Summary of HKMA's existing activities related to the recommendations 


Existing activities 


The HKMA has issued 4 Regtech Watches since November 2019 outlining Regtech benefits and high-level 
example use cases across Cyber risk, Credit risk, AML/CFT and Conduct. 


The HKMA hosted the AML/CFT RegTech Forum in November 2019 and published the Record of Discussion 
to provide supervisory encouragement and set the momentum for ongoing engagement and adoption efforts. 
The HKMA has also issued 5 circulars since February 2019 articulating the key regulatory principles and sharing 
good practices of remote customer on-boarding. 


‘Risk Assessment Form on Technology-related Outsourcing (including Cloud Computing) Project’ issued to set 
out assessment areas when adopting cloud-based solutions. 


2 circulars issued in November 2019 — High-level Principles on Artificial Intelligence*’ and Consumer Protection 
in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions’. 


Co-hosting of the Fintech Haccelerator programme with Cyberport, offering banks and stored value facilities 
operators a platform to run fintech-related competitions such as hackathons and hackcelerators. 


Conducted a study on MRR suggesting that the relevant technical standards (e.g. use of Al and machine 
learning techniques to interpret regulations) are still at an experimental stage, while the coding of regulations 
into computer programmes has only been tested on a very limited scale. 


Collaboration between the respective governments and regulators in Mainland China, Hong Kong and Macau 
in recent years has yielded a range of technology-related developments (e.g. Cyberport expansion, Science & 
Technology Park, R&D tax incentives, cross-boundary technology corporation). 


By the end of October 2020, the HKMA has signed co-operation agreements with 10 jurisdictions with a view 
to strengthening fintech collaboration through referral of innovative businesses, information and experience 
sharing, joint innovative projects, and expertise sharing. 


In line with international regulatory practices, there are established supervisory cooperation and coordination 
mechanisms and arrangements (e.g. MoU, bilateral meetings and supervisory colleges) between the HKMA 
and foreign regulatory authorities. 





The HKMA also participates actively in international regulatory fora relating to fintech development and 
supervision: 


(a) FSB Working Group on Regulatory Issues of Stablecoins to identify potential regulatory and supervisory 
concerns with respect to stablecoins; 


(b) FSB Working Group on Cyber Incident Response and Recovery to develop a toolkit of effective practices to 
assist financial institutions as well as supervisors in preparing for and responding to a cyber incident; 


(c) Supervision and Implementation Group (SIG) Task Force on Financial Technology to assess the risks and 
supervisory challenges associated with the innovation and technological changes affecting banking; 


(d) SIG Operational Resilience Working Group to assess issues related to cyber-risk and broader operational 
resilience; and 


(e) GFIN to support financial innovation and to create a framework for cooperation between regulators to share 
experiences and approaches for innovation. 


Periodic release of circulars and guidance notes relating to Regtech or underlying technologies. 


The HKMA’‘s Enhanced Competency Framework for Banking Practitioners provides a set of competency 
standards that enables more effective training for new entrants and professional development for existing 
practitioners. 








4" High-level Principles on Artificial Intelligence, Hong Kong Monetary Authority (November 2019), https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and- 
circular/2019/20191101e1.pdf 

42 Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions, Hong Kong Monetary Authority (November 2019), https://www.hkma.gov.hk/ 
media/eng/doc/key-information/guidelines-and-circular/2019/20191105e1.pdf 
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Fintech Supervisory Sandbox 2.0 introduced the Supervisory Chatroom which allows Regtech providers to 
participate, greater focus on Regtech, and a single entry point for HKMA, IA and SFC sandboxes. 


Established supervisory coordination and collaboration mechanisms (e.g. memoranda of understanding and 
bilateral meetings) among the HKMA, SFC and IA on regulatory policy issues and supervisory matters. 


The Government has established high-level cross-sectoral platforms (e.g. Council of Financial Regulators and 
the Financial Stability Committee) to facilitate effective exchanges on important cross-sectoral regulatory and 
supervisory issues, including the supervision and monitoring of fintech activities. 


Memorandum of Understanding with the Applied Science and Technology Research Institute (ASTRI), 
Cyberport and the Hong Kong Science and Technology Parks (HKSTP) to form a strategic partnership on 
fintech development. 


HKMA-ASTRI Fintech Innovation Hub to provide a neutral ground where various stakeholders in the fintech 
industry can collaborate to innovate. 


Co-host Haccelerator programme in collaboration with Cyberport. 


Fin+Tech Collaboration Platform with the HKSTP to support fintech development in a technology-centric 
approach. 





The following table (Figure 19) sets out a high-level recommendations, planning is already in an advanced 
roadmap of planned initiatives from the list of stage in order to meet key annual milestones where 
recommendations that have been developed to aid there are opportunities to amplify the impact of certain 
implementation over the next two years. For several recommendations. 


Figure 19: High-level roadmap of planned initiatives from the recommendations 


Roadmap of planned initiatives Target kick-off 


Develop a Regtech knowledge hub that acts as a central repository of all Regtech- 


related content and knowledge sharing for the Hong Kong banking industry. CeO | 


Develop a "Regtech Adoption Practice Guides" series that could potentially build on or 


supersede the "Regtech Watch" newsletter series. See 


Host a large-scale Regtech event. Q1 - Q2 2021 


Devote some of the “Regtech Adoption Practice Guides” series noted above 


(Recommendation 2) to focus on how to utilise the key technologies enabling Regtech Q1 - Q2 2021 
adoption. 


Host a Regtech Challenge in the form of a hackcelerator-style event. Q1 - Q2 2021 


Develop a Regtech skills framework that identifies the skills required for different roles 


to accelerate the adoption of Regtech. See 


Develop an RAI that covers actual adoption, intent to adopt, as well as key enablers for 
adoption. The RAI will measure banks’ Regtech adoption propensity and preparedness Q1 - Q2 2021 
across four pillars — Investment, Adoption, Talent & Culture, and Impact. 
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Appendix 


6.1 Survey approach 


Two separate online surveys targeting Authorized Institutions and Regtech companies were conducted from July until 
August 2020. 


e For Authorized Institutions, the HKMA supported in distributing the survey to 190 Authorized Institutions, and received 
a total of 133 responses (70%). 


e For Regtech companies, we have leveraged KPMG's global network and connection with Matchi, as well as the FinTech 
Association of Hong Kong's membership base, and distributed the survey to Regtech companies from Hong Kong, 
United Kingdom, United States, Ireland, Singapore, Australia, South Africa and a number of other jurisdictions. 
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6.2 Interviewee list 


In writing this report, interviews were conducted with industry participants, Regtech service providers and regulators. We 
would like to thank all of those involved in both the survey and the interviews for their kind participation. 


1 Australian Securities and Investments Commission 
Bank of China (Hong Kong) 
BIS Innovation Hub, Bank for International Settlements 
Cathay United Bank 
Chekk 


2 

3 

4 

5 

6 China Construction Bank (Asia) 
7 Credit Suisse 

8 Financial Conduct Authority 

9 FinTech Association of Hong Kong - Regtech Committee 
10 HSBC 

11 Insurance Authority 

12 J.P. Morgan 

13 Monetary Authority of Singapore 

14 — Securities and Futures Commission 

15 Standard Chartered Bank 

16 Vermeg 


17 WeLab Bank 


We would like to thank the range of regional and technical experts from around KPMG involved in this white paper 
including Anson Bailey, John Chan, Tek Yew Chia, Marcos Chow, Freda Gray, James Harte, Jeffrey Hau, Tom Jenkins, 
Rani Kamaruddin, Will Liang, James Mckeogh, Paul McSheaffrey, James O'Callaghan, Peter Outridge, lan Pollari, Anton 
Ruddenklau, Henry Shek, Jianing Song, Stanley Sum. 


We would also like to thank KPMG co-authors Paul McSheaffrey, James Harte and John Chan, editor Kanishk Verghese, 
and research analysts Tyler Chan, Debbie Lam and Thomas Lee. 


6.3 About KPMG Matchi 


Acquired by KPMG in 2017, Matchi is a leading global innovation and matchmaking platform that connects financial 
institutions and other large companies, with leading-edge, emerging technology solutions and innovators worldwide. 
Matchi partners with hosts of Global Innovation Challenges to identify and source targeted, relevant and market-ready 
emerging technology, as well as promotes challenges to its global community of emerging technology providers. 
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